From d02c0c2cd8a4862af1b49c7f8e603b60e63c3ba0 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 3 Nov 2026 00:26:52 +0100 Subject: [PATCH] Security night 2026-11-02: the triage, six proven 9202 walks + the negative control, three bench runs, the watch's logs on both runners (evidence only); 05/07 design lines for R-1352, R-1347, R-1348. Docs only. --- .../architecture/05-hub-architecture.md | 4 +- .../architecture/07-backup-architecture.md | 6 + .../audits/security-2026-11-02/TRIAGE.md | 47 + .../bench/mealie/MV-mealie.log | 115 + .../bench/mealie/abort-refusal.txt | 40 + .../bench/mealie/abort-states.json | 8 + .../bench/mealie/compose-final.log | 2499 +++++++++++++++++ .../bench/mealie/engine-state.json | 1 + .../bench/mealie/files-after-detail.json | 1 + .../bench/mealie/files-after.json | 1 + .../bench/mealie/files-before-detail.json | 1 + .../bench/mealie/files-before.json | 1 + .../bench/mealie/memory-samples.json | 802 ++++++ .../bench/mealie/migration-lines.txt | 6 + .../security-2026-11-02/bench/mealie/run.log | 57 + .../bench/mealie/to-full.log | 144 + .../bench/mealie/to-states.json | 8 + .../bench/mealie/verdict.json | 58 + .../bench/paperless-ngx/MV-paperless-ngx.log | 156 + .../bench/paperless-ngx/abort-refusal.txt | 88 + .../bench/paperless-ngx/abort-states.json | 20 + .../bench/paperless-ngx/compose-final.log | 523 ++++ .../bench/paperless-ngx/engine-state.json | 8 + .../paperless-ngx/files-after-detail.json | 7 + .../bench/paperless-ngx/files-after.json | 5 + .../paperless-ngx/files-before-detail.json | 7 + .../bench/paperless-ngx/files-before.json | 5 + .../bench/paperless-ngx/memory-samples.json | 1922 +++++++++++++ .../bench/paperless-ngx/migration-lines.txt | 6 + .../bench/paperless-ngx/run.log | 59 + .../bench/paperless-ngx/to-full.log | 216 ++ .../bench/paperless-ngx/to-states.json | 20 + .../bench/paperless-ngx/verdict.json | 97 + .../bench/termix/MV-termix.log | 116 + .../bench/termix/abort-states.json | 8 + .../bench/termix/compose-final.log | 95 + .../bench/termix/engine-state.json | 1 + .../bench/termix/files-after-detail.json | 1 + .../bench/termix/files-after.json | 1 + .../bench/termix/files-before-detail.json | 1 + .../bench/termix/files-before.json | 1 + .../bench/termix/memory-samples.json | 802 ++++++ .../bench/termix/migration-lines.txt | 6 + .../security-2026-11-02/bench/termix/run.log | 58 + .../bench/termix/to-full.log | 91 + .../bench/termix/to-states.json | 8 + .../bench/termix/verdict.json | 58 + .../part1/dry-2549-runner-after.log | 257 ++ .../part1/dry-2554-runner-after.log | 257 ++ .../part1/dry-2555-runner2-after.log | 257 ++ .../part1/run-2550-runner-after.log | 286 ++ .../part4/hub-slow-lines-2026-11-01-02.txt | 35 + .../part4/restore-test-demo-hp.txt | 3 + .../part4/restore-test-n100.txt | 11 + .../part4/restore-test-tester1.txt | 12 + .../part4/romm-demo-hp-app-yaml.txt | 69 + .../audits/security-2026-11-02/waiters.txt | 26 + .../box-verdict-n8n.json | 48 + .../walks/_n8n-try1-fixture-race/walk.txt | 22 + .../box-verdict-privatebin.json | 188 ++ .../walks/_negative-control/walk.txt | 23 + .../box-verdict-vaultwarden.json | 47 + .../_vaultwarden-try2-guard-mirror/walk.txt | 11 + .../box-verdict-vaultwarden.json | 49 + .../_vaultwarden-try3-route-moved/walk.txt | 17 + .../box-verdict-vaultwarden.json | 49 + .../_vaultwarden-try4-needs-token/walk.txt | 13 + .../box-verdict-actualbudget.json | 225 ++ .../walks/actualbudget/walk.txt | 24 + .../walks/gitea/box-verdict-gitea.json | 228 ++ .../security-2026-11-02/walks/gitea/walk.txt | 29 + .../walks/grafana/box-verdict-grafana.json | 223 ++ .../walks/grafana/walk.txt | 24 + .../walks/n8n/box-verdict-n8n.json | 232 ++ .../security-2026-11-02/walks/n8n/walk.txt | 25 + .../uptime-kuma/box-verdict-uptime-kuma.json | 224 ++ .../walks/uptime-kuma/walk.txt | 25 + .../vaultwarden/box-verdict-vaultwarden.json | 224 ++ .../walks/vaultwarden/walk.txt | 25 + 79 files changed, 11372 insertions(+), 1 deletion(-) create mode 100644 documentation/audits/security-2026-11-02/TRIAGE.md create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/MV-mealie.log create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/abort-refusal.txt create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/abort-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/compose-final.log create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/engine-state.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/files-after-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/files-after.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/files-before-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/files-before.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/memory-samples.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/migration-lines.txt create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/run.log create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/to-full.log create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/to-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/mealie/verdict.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/MV-paperless-ngx.log create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-refusal.txt create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/compose-final.log create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/engine-state.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/memory-samples.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/migration-lines.txt create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/run.log create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/to-full.log create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/to-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/paperless-ngx/verdict.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/MV-termix.log create mode 100644 documentation/audits/security-2026-11-02/bench/termix/abort-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/compose-final.log create mode 100644 documentation/audits/security-2026-11-02/bench/termix/engine-state.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/files-after-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/files-after.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/files-before-detail.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/files-before.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/memory-samples.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/migration-lines.txt create mode 100644 documentation/audits/security-2026-11-02/bench/termix/run.log create mode 100644 documentation/audits/security-2026-11-02/bench/termix/to-full.log create mode 100644 documentation/audits/security-2026-11-02/bench/termix/to-states.json create mode 100644 documentation/audits/security-2026-11-02/bench/termix/verdict.json create mode 100644 documentation/audits/security-2026-11-02/part1/dry-2549-runner-after.log create mode 100644 documentation/audits/security-2026-11-02/part1/dry-2554-runner-after.log create mode 100644 documentation/audits/security-2026-11-02/part1/dry-2555-runner2-after.log create mode 100644 documentation/audits/security-2026-11-02/part1/run-2550-runner-after.log create mode 100644 documentation/audits/security-2026-11-02/part4/hub-slow-lines-2026-11-01-02.txt create mode 100644 documentation/audits/security-2026-11-02/part4/restore-test-demo-hp.txt create mode 100644 documentation/audits/security-2026-11-02/part4/restore-test-n100.txt create mode 100644 documentation/audits/security-2026-11-02/part4/restore-test-tester1.txt create mode 100644 documentation/audits/security-2026-11-02/part4/romm-demo-hp-app-yaml.txt create mode 100644 documentation/audits/security-2026-11-02/waiters.txt create mode 100644 documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/box-verdict-n8n.json create mode 100644 documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/_negative-control/box-verdict-privatebin.json create mode 100644 documentation/audits/security-2026-11-02/walks/_negative-control/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/box-verdict-vaultwarden.json create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try3-route-moved/box-verdict-vaultwarden.json create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try3-route-moved/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try4-needs-token/box-verdict-vaultwarden.json create mode 100644 documentation/audits/security-2026-11-02/walks/_vaultwarden-try4-needs-token/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/actualbudget/box-verdict-actualbudget.json create mode 100644 documentation/audits/security-2026-11-02/walks/actualbudget/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/gitea/box-verdict-gitea.json create mode 100644 documentation/audits/security-2026-11-02/walks/gitea/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/grafana/box-verdict-grafana.json create mode 100644 documentation/audits/security-2026-11-02/walks/grafana/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/n8n/box-verdict-n8n.json create mode 100644 documentation/audits/security-2026-11-02/walks/n8n/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/uptime-kuma/box-verdict-uptime-kuma.json create mode 100644 documentation/audits/security-2026-11-02/walks/uptime-kuma/walk.txt create mode 100644 documentation/audits/security-2026-11-02/walks/vaultwarden/box-verdict-vaultwarden.json create mode 100644 documentation/audits/security-2026-11-02/walks/vaultwarden/walk.txt diff --git a/documentation/architecture/05-hub-architecture.md b/documentation/architecture/05-hub-architecture.md index b0660c63..554d08c1 100644 --- a/documentation/architecture/05-hub-architecture.md +++ b/documentation/architecture/05-hub-architecture.md @@ -849,4 +849,6 @@ cost is 3 minutes of disk load. The vouch save answers in the request: its datab background save is needed. **R-1344 restart:** the hub mails `controller_unresponsive_restart` (warning, operator-only) when the stanza's `unresponsive_restart_at` moves, and not also `controller_restarted_by_agent` for that act; the `controller_unresponsive` text says when the agent restarts (`unresponsive_restart_after_s`), or that an older agent -does not. +does not. **R-1352 (2026-11-02, hub commit only):** the alarm of an episode whose restart arrives in the same report is not +emitted: the restart's mail says all of it. An episode that began after that restart still alarms; a time that cannot be read +counts as a new episode (`episodeRestarted`, `TestR1352_*`). diff --git a/documentation/architecture/07-backup-architecture.md b/documentation/architecture/07-backup-architecture.md index 51afa7c7..32086b30 100644 --- a/documentation/architecture/07-backup-architecture.md +++ b/documentation/architecture/07-backup-architecture.md @@ -813,6 +813,12 @@ returns), or a copy gone while its drive is bound, leaves the app **held** with the copy kept, and the marker lets go of the app — never stopped-and-unheld (H2). Stop pressed during the restore still gets the put-back; only the start is skipped (H7). A removal clears a waiting put-back; a later restore that completes drops it (the household chose that data). The copy's folders are synced to disk BEFORE the marker names the copy. +**`[DESIGN]` 2026-11-02 — a failed put-back at start-up reaches the operator; a restore that lifts an update hold forgets the +in-memory flag (R-1348, R-1347; controller `c4b6844`, commit only).** The hold from `Recover` is written before any notifier exists, so +the guard keeps the name and `SetHeldNotify` (main.go, where the notifier is wired) sends the R-1340 sentence once; a later failure, a +drive that returned, mails at once. `clearUpdateHoldAfterRestore` also calls `ForgetUpdateHeld` through `SetUpdateHeldForgetter`: the +hold store and the flag go together, as in the operator's clear (R-1343), so the crash-loop watcher and the night leg take the +restored app again. Live proof: `audits/security-2026-11-02/part3/`. **`[FACT]` 2026-10-24 night, Tester 1 (VM 341; MeTube on the data drive, 1.5 GB in its volume; `audits/restore-holes-2026-10-24/P1-tester1/`):** a local restore cut by powering the VM off 2.1 s after „the restore copy is recorded", the data disk taken off, the box booted: held as waiting, Start and Update refused (409, the diff --git a/documentation/audits/security-2026-11-02/TRIAGE.md b/documentation/audits/security-2026-11-02/TRIAGE.md new file mode 100644 index 00000000..b46d6ad3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/TRIAGE.md @@ -0,0 +1,47 @@ +# Security notices first seen since 2026-10-29 — the triage (2026-11-02 night) + +Input: the watch's memory (`documentation/security-watch/state.json`, every notice with `first` ≥ 2026-10-29) plus the fixed +watch's dry run (`part1/dry-local-after-fix.log`, 13 new lines). Each notice was read in its own text (the release body, the GHSA); +the versions of the waiters were **read from the image** (`waiters.txt`), never from notes. Fleet: three test boxes report, no +household. „Lane" = a `security_fix` step (`09` §3 decision 255): same main version, a public id, a proven 9202 walk. + +## The table of the brief + +| App (our pin) | Notice | Real? | Reach in our template | Fixed in | What happens | +|---|---|---|---|---|---| +| Vaultwarden 1.37.4-alpine | release 1.37.5: GHSA-x9cq-f669-vrr4 (website icons, medium 5.3), GHSA-9pjj-f9g5-3x4c (emergency access, medium 4.3); both still private upstream | **real** | own login; the icon route is public | 1.37.5-alpine | **Lane.** Upgrade notes: „invalid values now stop startup" — our template sets none of the named options (grep) | +| Uptime Kuma 2.5.7 | GHSA-86ch-2247-gr56 (unauth RSS cache poisoning by Host header, medium, `>= 2.1.0, <= 2.5.8`); GHSA-v2p3-6f5h-6hhf (admin-only RCE via Apprise, high, fixed 2.5.8) | **real** | RSS only if a public status page exists; v2p3 needs the admin | 2.5.9 | **Lane**, and it crosses 2.5.8, which the 10-27 batch refused: it drops TLS on the TCP-port monitor. Upstream: „never worked as expected … all existing monitors will become normal TCP monitors". Decided by CC unattended (operator may reverse): the fix outweighs it, no box runs Kuma, and no data is touched. Named on the list | +| n8n 2.44.7 | 12 GHSAs first seen 10-29 | **real** | own login; two reach before login (`GHSA-426f` OAuth callback, `GHSA-mx4r` Asana trigger) | nine in 2.45.5 / 2.46.1; **three only in 3.0.1** (`GHSA-9p7v` high, `GHSA-mx4r`, `GHSA-2x68`) | **Lane to 2.46.4** for the nine; the three go to a big step (a new main version), row filed. `GHSA-365g` names no fix | +| PrivateBin 2.1.0 | GHSA-hw9p-r7fq-8mvr (comment replay, medium), GHSA-c4gc-8mcm-hh65 (2.1.0's XSS fix is ineffective, medium) | **real** | public by design | 2.1.1 — **no release and no image exist** (PrivateBin's newest release is 2.1.0; `privatebin/pdo` has no 2.1.1 tag) | **No step tonight.** Row filed; the watch keeps it open | +| Traefik v3.7.16 (box) | `release:traefik@v3.7.17` | **REAL — not the false alarm the brief expected.** The word-only line („Point security announcements …") hid a real id in the same notes: **GHSA-xv5x-242w-7hf7, high, published 2026-11-02 09:15 UTC**: an unauthenticated client holds a backend transport per connection (v3.7.14–v3.7.16) until memory runs out, NTLM backend or not | every box, in front of everything | v3.7.17 | **Pin committed**, controller `c4b6844`; proven on 9202 on the test image. **First on the release list** | + +## What else was first seen since Thursday + +| App (our pin) | Notice | Real? | What happens | +|---|---|---|---| +| Gitea 28.2.0 (catalog) | 21 GHSAs fixed in 28.3.0 (high: `GHSA-8p3x` OAuth2 auto-link account takeover, `GHSA-jh8p`, `GHSA-37xv`, `GHSA-8g99`, `GHSA-32h8`, `GHSA-9v6p`, `GHSA-6h2f`) | **real** | **Lane.** `GHSA-x4q3` is the runner's, not ours (now not listed, R-1310) | +| Gitea 1.26.2 on **DooPlex** | 19 of the same | **real, on the host that holds our code and registry** | Not ours to touch: homelab list, filed; first on that list | +| Vaultwarden 1.37.4, Uptime Kuma 2.5.6 on **DooPlex** | as above | real | Homelab list | +| FileBrowser 1.5.8-stable (box) | GHSA-892f-9h5p-mfc8 (low): `/api/settings` shows secrets to an ADMIN's token | real, admin only | R-1305's list; the fix is on 2.1.0-stable (a new main version) | +| cloudflared 2026.10.4 (box) | VULN-183456 (2026.10.5, chi bump), VULN-184686 (2026.10.6, go-jose bump) | real dependency fixes, no public text on reach | Row filed: raise it on a controller release after a tunnel proof (the newest is 2026.10.7). Not pinned tonight: the tunnel is a box's only door, and 9202 has none to prove it on | +| Grafana 13.2.4 | release 13.2.5 names four CVEs (first seen 10-28) | real | **Lane.** | +| Mealie v3.29.0 | v3.30.0: „update dependency pillow to v13 [security]" | a dependency fix, no id | Normal step (bench + box, drill only). v3.30.0 also removes `OPENAI_CUSTOM_PROMPT_DIR` (imported automatically; our template does not set it). Row filed | +| Termix 26.10.5 | v26.10.6: „body-parser is updated to 2.4.0 for a security fix" | a dependency fix, no id | Normal step, drill only. Row filed | +| Meilisearch v1.41.0 (karakeep), v1.36.0 (wanderer) | v1.55.1 / v1.56.1: „important security fixes" (long filters, rustls) | real, but the search engine sits on the app's private network | Not reachable from outside. A jump of 15–20 versions needs its dump migration: a big step. Row filed | +| Actual 26.9.0 | GHSA-p7p2-pm6f-rg6x (Electron fuse, desktop app) | `NOT-A-FINDING`: the desktop client, we run the server | Fixed in 26.11.0 anyway, the waiter's step below | +| Paperless 3.3.4 on DooPlex | v3.4.0 „bump some frontend deps for security fixes" | real | Homelab list | + +## The six HTTP2Shell waiters (CVE-2026-111497) — read from the image + +| App | Pin | Newest same shape | Runtime in the newest | Fixed release? | What happens | +|---|---|---|---|---|---| +| ActualBudget (R-1336) | 26.9.0 (Node 24.20.0) | 26.11.0 | **Node 24.22.1** | **YES**, same main | **Lane** | +| cal.com (R-1329, R-1325) | v6.2.0 (Node 20.20.0) | v6.2.0 | Node 20.20.0 | no | Waits | +| Calibre-Web (R-1337) | v4.0.8 (Python Brotli 1.2.0) | v4.0.8 | same | no | Waits | +| Paperless (R-1331) | 2.20.15 (Python Brotli 1.1.0) | 3.4.1 | **clean** (3.4.0 and 3.4.1; 3.3.4 still bad) | **YES, a new main version** | Big step: bench + 9202 + undo, drill only | +| RomM (R-1330) | 5.4.1 (Node 24.18.1) | 5.4.1 | same | no | Waits (D61) | +| SparkyFitness | v0.17.3 (Node 24.18.0) | v1.11.0 | **Node 24.22.1** (v1.10.0 and v1.11.0; v1.9.0 still bad) | **YES, a new main version** | Big step; R-784 (licence) and R-785 stand before it | + +## The walks + +See `walks//walk.txt` and `box-verdict-.json`; the result of each is in the close-out below. diff --git a/documentation/audits/security-2026-11-02/bench/mealie/MV-mealie.log b/documentation/audits/security-2026-11-02/bench/mealie/MV-mealie.log new file mode 100644 index 00000000..cd3c9f03 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/MV-mealie.log @@ -0,0 +1,115 @@ +[22:32:46] scratch drive folders cleared before FROM (R-656): none existed +[22:32:46] MV-mealie: deploying mealie at FROM {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.29.0'} +[22:33:57] FROM settled=True in 31.0s :: {"mealie": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:33:57] fixture: the BOX walk's own (Mealie), through upgrade_boxport +[22:33:59] mealie: create recipe http=201 +[22:34:00] mealie: readback of the seeded recipe http=200 ok=True +[22:34:00] C1 (seed reads back BEFORE): True +[22:34:00] MV-mealie: swapping to TO {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.30.0'} +[22:34:39] TO up -d rc=0 +[22:35:10] TO settled=True in 30.9s :: {"mealie": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:35:10] migration lines observed: 6 +[22:35:12] mealie: readback of the seeded recipe http=200 ok=True +[22:35:12] RESULT (seed reads back AFTER): True +[22:35:12] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:9000 +[22:35:27] + 15s mealie=256M/1000M peak=257M kills=0 rs=0 reqs=278 +[22:35:42] + 30s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=561 +[22:35:57] + 45s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=843 +[22:36:13] + 60s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1129 +[22:36:28] + 76s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1412 +[22:36:43] + 91s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1698 +[22:36:58] + 106s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=1981 +[22:37:13] + 121s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=2268 +[22:37:28] + 136s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=2550 +[22:37:43] + 151s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=2837 +[22:37:58] + 166s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=3125 +[22:38:14] + 182s mealie=256M/1000M peak=267M kills=0 rs=0 reqs=3411 +[22:38:29] + 197s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=3701 +[22:38:44] + 212s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=3987 +[22:38:59] + 227s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4273 +[22:39:14] + 242s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4561 +[22:39:29] + 257s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4849 +[22:39:45] + 272s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=5140 +[22:40:00] + 288s mealie=262M/1000M peak=267M kills=0 rs=0 reqs=5417 +[22:40:15] + 303s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=5699 +[22:40:30] + 318s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=5981 +[22:40:45] + 333s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6262 +[22:41:00] + 348s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6549 +[22:41:15] + 363s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6831 +[22:41:31] + 378s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=7116 +[22:41:46] + 394s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=7401 +[22:42:01] + 409s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=7683 +[22:42:16] + 424s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=7971 +[22:42:31] + 439s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=8253 +[22:42:46] + 454s mealie=262M/1000M peak=273M kills=0 rs=0 reqs=8543 +[22:43:01] + 469s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=8830 +[22:43:16] + 484s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9113 +[22:43:32] + 500s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9400 +[22:43:47] + 515s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9682 +[22:44:02] + 530s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9965 +[22:44:17] + 545s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10251 +[22:44:32] + 560s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10535 +[22:44:47] + 575s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10821 +[22:45:02] + 590s mealie=264M/1000M peak=273M kills=0 rs=0 reqs=11104 +[22:45:18] + 606s mealie=265M/1000M peak=273M kills=0 rs=0 reqs=11386 +[22:45:18] memory watch: killed=False tight=[] requests=11386 codes={'200': 11386} +[22:45:18] MV-mealie: ABORT — putting the FROM images back +[22:48:25] ABORT: the app did NOT come back (rc=0, 184.8s) +{ + "harness_version": 5, + "edge": "MV-mealie", + "app": "mealie", + "note": "night 2026-09-23 within-a-major move: mealie=ghcr.io/mealie-recipes/mealie:v3.30.0", + "from": { + "mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0" + }, + "to": { + "mealie": "ghcr.io/mealie-recipes/mealie:v3.30.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kmealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.schemas", + "abort": "refuses", + "abort_detail": "ncestor=\"Destination %(end)s is not a valid upgrade \"\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | \"target from current head(s)\",\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | end=destination,\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | ):\n\u001b[2Kmealie | ^\n\u001b[2Kmealie | File \"/usr/local/lib/python3.14/contextlib.py\", line 162, in __exit__\n\u001b[2Kmealie | self.gen.throw(value)\n\u001b[2Kmealie | ~~~~~~~~~~~~~~^^^^^^^\n\u001b[2Kmealie | File \"/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py\", line 239, in _catch_revision_errors\n\u001b[2Kmealie | raise util.CommandError(resolution) from re\n\u001b[2Kmealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851'\n\u001b[2Kmealie | \n\u001b[2Kmealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting.", + "engine_state_after": null, + "memory": { + "soak_s": 605.6, + "requested_s": 600, + "requests": 11386, + "codes": { + "200": 11386 + }, + "first_kill": null, + "containers": { + "mealie": { + "limit": 1048576000, + "peak": 287174656, + "peak_pct": 0.274, + "anon_peak_sampled": 246857728, + "anon_peak_pct": 0.235, + "anon_live_peak_sampled": 246853632, + "anon_live_peak_pct": 0.235, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-11-02T22:48:25Z", + "evidence": "evidence/MV-mealie", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 938.8 +} diff --git a/documentation/audits/security-2026-11-02/bench/mealie/abort-refusal.txt b/documentation/audits/security-2026-11-02/bench/mealie/abort-refusal.txt new file mode 100644 index 00000000..bfb4a6d0 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/abort-refusal.txt @@ -0,0 +1,40 @@ +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting. +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting. \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/abort-states.json b/documentation/audits/security-2026-11-02/bench/mealie/abort-states.json new file mode 100644 index 00000000..b90a26a3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/abort-states.json @@ -0,0 +1,8 @@ +{ + "mealie": { + "status": "restarting", + "health": "unhealthy", + "restarts": 0, + "exit": 3 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/compose-final.log b/documentation/audits/security-2026-11-02/bench/mealie/compose-final.log new file mode 100644 index 00000000..c8b85009 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/compose-final.log @@ -0,0 +1,2499 @@ +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:45:27 - Started server process [1] +mealie | INFO 2026-11-02T23:45:27 - Waiting for application startup. +mealie | INFO 2026-11-02T23:45:27 - start: database initialization +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:45:27 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:45:27 - Database connection established. +mealie | INFO 2026-11-02T23:45:27 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:27 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:45:27 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:45:27 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:27 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:45:28 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | ERROR 2026-11-02T23:45:28 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:28 - Application startup failed. Exiting. +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:28 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:45:37 - Started server process [1] +mealie | INFO 2026-11-02T23:45:37 - Waiting for application startup. +mealie | INFO 2026-11-02T23:45:37 - start: database initialization +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:45:37 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:45:37 - Database connection established. +mealie | INFO 2026-11-02T23:45:37 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:37 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:45:37 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:45:37 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:37 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:45:37 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | ERROR 2026-11-02T23:45:37 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:37 - Application startup failed. Exiting. +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:37 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:45:45 - Started server process [1] +mealie | INFO 2026-11-02T23:45:45 - Waiting for application startup. +mealie | INFO 2026-11-02T23:45:45 - start: database initialization +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:45:45 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:45:45 - Database connection established. +mealie | INFO 2026-11-02T23:45:45 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:45 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:45:45 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:45:45 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:45 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:45:45 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | ERROR 2026-11-02T23:45:45 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:45 - Application startup failed. Exiting. +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:45 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:45:55 - Started server process [1] +mealie | INFO 2026-11-02T23:45:55 - Waiting for application startup. +mealie | INFO 2026-11-02T23:45:55 - start: database initialization +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:45:55 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:45:55 - Database connection established. +mealie | INFO 2026-11-02T23:45:55 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:55 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:45:55 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:45:55 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:45:55 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:45:55 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:55 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:45:55 - Application startup failed. Exiting. +mealie | ERROR 2026-11-02T23:45:55 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:46:04 - Started server process [1] +mealie | INFO 2026-11-02T23:46:04 - Waiting for application startup. +mealie | INFO 2026-11-02T23:46:04 - start: database initialization +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:46:04 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:46:04 - Database connection established. +mealie | INFO 2026-11-02T23:46:04 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:04 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:46:04 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:46:04 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:04 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:46:04 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | ERROR 2026-11-02T23:46:04 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:04 - Application startup failed. Exiting. +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:04 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:46:14 - Started server process [1] +mealie | INFO 2026-11-02T23:46:14 - Waiting for application startup. +mealie | INFO 2026-11-02T23:46:14 - start: database initialization +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:46:14 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:46:14 - Database connection established. +mealie | INFO 2026-11-02T23:46:14 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:14 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:46:14 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:46:14 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:14 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:46:14 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | ERROR 2026-11-02T23:46:14 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:14 - Application startup failed. Exiting. +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:14 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:46:27 - Started server process [1] +mealie | INFO 2026-11-02T23:46:27 - Waiting for application startup. +mealie | INFO 2026-11-02T23:46:27 - start: database initialization +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:46:27 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:46:27 - Database connection established. +mealie | INFO 2026-11-02T23:46:27 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:27 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:46:27 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:46:27 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:27 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:46:27 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ERROR 2026-11-02T23:46:27 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~^^^^^^ +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | The above exception was the direct cause of the following exception: +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | +mealie | ERROR 2026-11-02T23:46:27 - Application startup failed. Exiting. +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:27 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:46:42 - Started server process [1] +mealie | INFO 2026-11-02T23:46:42 - Waiting for application startup. +mealie | INFO 2026-11-02T23:46:42 - start: database initialization +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:46:42 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:46:42 - Database connection established. +mealie | INFO 2026-11-02T23:46:42 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:42 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:46:42 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:46:42 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:46:42 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:46:42 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ERROR 2026-11-02T23:46:42 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:42 - Application startup failed. Exiting. +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:46:42 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:47:03 - Started server process [1] +mealie | INFO 2026-11-02T23:47:03 - Waiting for application startup. +mealie | INFO 2026-11-02T23:47:03 - start: database initialization +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:47:03 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:47:03 - Database connection established. +mealie | INFO 2026-11-02T23:47:03 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:47:03 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:47:03 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:47:03 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:47:03 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:47:03 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | ERROR 2026-11-02T23:47:03 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | for step in self._migrations_fn(heads, self): +mealie | ERROR 2026-11-02T23:47:03 - Application startup failed. Exiting. +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:47:03 - Application startup failed. Exiting. +mealie | usermod: no changes +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:47:37 - Started server process [1] +mealie | INFO 2026-11-02T23:47:37 - Waiting for application startup. +mealie | INFO 2026-11-02T23:47:37 - start: database initialization +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:47:37 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:47:37 - Database connection established. +mealie | INFO 2026-11-02T23:47:37 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:47:37 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:47:37 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:47:37 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:47:37 - Will assume non-transactional DDL. +mealie | ERROR 2026-11-02T23:47:37 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | ERROR 2026-11-02T23:47:37 - Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 207, in _catch_revision_errors +mealie | yield +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 426, in _upgrade_revs +mealie | for script in reversed(list(revs)) +mealie | ~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 807, in iterate_revisions +mealie | revisions, heads = fn( +mealie | ~~^ +mealie | upper, +mealie | ^^^^^^ +mealie | ...<3 lines>... +mealie | assert_relative_length=assert_relative_length, +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | ) +mealie | ^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 1468, in _collect_upgrade_revisions +mealie | current_revisions = self.get_revisions(lower) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 535, in get_revisions +mealie | return sum([self.get_revisions(id_elem) for id_elem in id_], ()) +mealie | ~~~~~~~~~~~~~~~~~~^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 558, in get_revisions +mealie | return tuple( +mealie | ^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 559, in +mealie | self._revision_for_ident(rev_id, branch_label) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/revision.py", line 630, in _revision_for_ident +mealie | raise ResolutionError( +mealie | ...<11 lines>... +mealie | ) +mealie | alembic.script.revision.ResolutionError: No such revision or branch '071e03b4f851' +mealie | +mealie | The above exception was the direct cause of the following exception: +mealie | +mealie | Traceback (most recent call last): +mealie | File "/opt/mealie/lib/python3.14/site-packages/starlette/routing.py", line 654, in lifespan +mealie | async with self.lifespan_context(app) as maybe_state: +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/fastapi/routing.py", line 247, in merged_lifespan +mealie | async with original_context(app) as maybe_original_state: +mealie | ~~~~~~~~~~~~~~~~^^^^^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 214, in __aenter__ +mealie | return await anext(self.gen) +mealie | ^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/app.py", line 67, in lifespan_fn +mealie | init_db.main() +mealie | ~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/db/init_db.py", line 119, in main +mealie | command.upgrade(alembic_cfg, "head") +mealie | ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 487, in upgrade +mealie | script.run_env() +mealie | ~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 550, in run_env +mealie | util.load_python_file(self.dir, "env.py") +mealie | ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 114, in load_python_file +mealie | module = load_module_py(module_id, path) +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/util/pyfiles.py", line 132, in load_module_py +mealie | spec.loader.exec_module(module) # type: ignore +mealie | ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^ +mealie | File "", line 763, in exec_module +mealie | File "", line 491, in _call_with_frames_removed +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 109, in +mealie | run_migrations_online() +mealie | ~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/mealie/alembic/env.py", line 103, in run_migrations_online +mealie | context.run_migrations() +mealie | ~~~~~~~~~~~~~~~~~~~~~~^^ +mealie | File "", line 8, in run_migrations +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/environment.py", line 970, in run_migrations +mealie | self.get_context().run_migrations(**kw) +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/runtime/migration.py", line 604, in run_migrations +mealie | for step in self._migrations_fn(heads, self): +mealie | ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^ +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting. +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/command.py", line 476, in upgrade +mealie | return script._upgrade_revs(revision, rev) +mealie | ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 414, in _upgrade_revs +mealie | with self._catch_revision_errors( +mealie | ~~~~~~~~~~~~~~~~~~~~~~~~~~~^ +mealie | ancestor="Destination %(end)s is not a valid upgrade " +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | "target from current head(s)", +mealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +mealie | end=destination, +mealie | ^^^^^^^^^^^^^^^^ +mealie | ): +mealie | ^ +mealie | File "/usr/local/lib/python3.14/contextlib.py", line 162, in __exit__ +mealie | self.gen.throw(value) +mealie | ~~~~~~~~~~~~~~^^^^^^^ +mealie | File "/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py", line 239, in _catch_revision_errors +mealie | raise util.CommandError(resolution) from re +mealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851' +mealie | +mealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting. diff --git a/documentation/audits/security-2026-11-02/bench/mealie/engine-state.json b/documentation/audits/security-2026-11-02/bench/mealie/engine-state.json new file mode 100644 index 00000000..ec747fa4 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/engine-state.json @@ -0,0 +1 @@ +null \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/files-after-detail.json b/documentation/audits/security-2026-11-02/bench/mealie/files-after-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/files-after-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/files-after.json b/documentation/audits/security-2026-11-02/bench/mealie/files-after.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/files-after.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/files-before-detail.json b/documentation/audits/security-2026-11-02/bench/mealie/files-before-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/files-before-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/files-before.json b/documentation/audits/security-2026-11-02/bench/mealie/files-before.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/files-before.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/memory-samples.json b/documentation/audits/security-2026-11-02/bench/mealie/memory-samples.json new file mode 100644 index 00000000..ca834854 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/memory-samples.json @@ -0,0 +1,802 @@ +[ + { + "t": 15.1, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269152256, + "peak": 269938688, + "anon": 240418816, + "anon_live": 240414720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 278 + }, + { + "t": 30.3, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269533184, + "peak": 279101440, + "anon": 240496640, + "anon_live": 240492544, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 561 + }, + { + "t": 45.4, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269082624, + "peak": 279101440, + "anon": 240541696, + "anon_live": 240537600, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 843 + }, + { + "t": 60.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269672448, + "peak": 279101440, + "anon": 240574464, + "anon_live": 240570368, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1129 + }, + { + "t": 75.6, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269701120, + "peak": 279101440, + "anon": 240599040, + "anon_live": 240594944, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1412 + }, + { + "t": 90.8, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269750272, + "peak": 279568384, + "anon": 240603136, + "anon_live": 240599040, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1698 + }, + { + "t": 105.9, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269262848, + "peak": 279568384, + "anon": 240599040, + "anon_live": 240594944, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1981 + }, + { + "t": 121.0, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269291520, + "peak": 279662592, + "anon": 240599040, + "anon_live": 240594944, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2268 + }, + { + "t": 136.1, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269062144, + "peak": 279662592, + "anon": 240627712, + "anon_live": 240623616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2550 + }, + { + "t": 151.3, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269578240, + "peak": 279662592, + "anon": 240623616, + "anon_live": 240619520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2837 + }, + { + "t": 166.4, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269320192, + "peak": 279662592, + "anon": 240619520, + "anon_live": 240615424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3125 + }, + { + "t": 181.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269352960, + "peak": 279982080, + "anon": 240619520, + "anon_live": 240615424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3411 + }, + { + "t": 196.6, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269660160, + "peak": 279982080, + "anon": 240623616, + "anon_live": 240619520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3701 + }, + { + "t": 211.8, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269938688, + "peak": 279982080, + "anon": 240619520, + "anon_live": 240615424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3987 + }, + { + "t": 226.9, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269713408, + "peak": 279982080, + "anon": 240619520, + "anon_live": 240615424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4273 + }, + { + "t": 242.0, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269746176, + "peak": 279982080, + "anon": 240619520, + "anon_live": 240615424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4561 + }, + { + "t": 257.2, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 269799424, + "peak": 279982080, + "anon": 240623616, + "anon_live": 240619520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4849 + }, + { + "t": 272.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 270131200, + "peak": 279982080, + "anon": 240648192, + "anon_live": 240644096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5140 + }, + { + "t": 287.6, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275189760, + "peak": 279982080, + "anon": 245796864, + "anon_live": 245792768, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5417 + }, + { + "t": 302.8, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 274997248, + "peak": 285601792, + "anon": 245829632, + "anon_live": 245825536, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5699 + }, + { + "t": 317.9, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276099072, + "peak": 285601792, + "anon": 245829632, + "anon_live": 245825536, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5981 + }, + { + "t": 333.1, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275107840, + "peak": 285761536, + "anon": 245829632, + "anon_live": 245825536, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6262 + }, + { + "t": 348.2, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275705856, + "peak": 285761536, + "anon": 245846016, + "anon_live": 245841920, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6549 + }, + { + "t": 363.3, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275488768, + "peak": 285958144, + "anon": 245846016, + "anon_live": 245841920, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6831 + }, + { + "t": 378.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275582976, + "peak": 285958144, + "anon": 245850112, + "anon_live": 245846016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7116 + }, + { + "t": 393.6, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275337216, + "peak": 285958144, + "anon": 245850112, + "anon_live": 245846016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7401 + }, + { + "t": 408.7, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275963904, + "peak": 285958144, + "anon": 245850112, + "anon_live": 245846016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7683 + }, + { + "t": 423.9, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276234240, + "peak": 285958144, + "anon": 245846016, + "anon_live": 245841920, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7971 + }, + { + "t": 439.0, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275779584, + "peak": 285958144, + "anon": 245850112, + "anon_live": 245846016, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8253 + }, + { + "t": 454.1, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275517440, + "peak": 286302208, + "anon": 245792768, + "anon_live": 245788672, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8543 + }, + { + "t": 469.2, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276602880, + "peak": 286302208, + "anon": 245796864, + "anon_live": 245792768, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8830 + }, + { + "t": 484.4, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275914752, + "peak": 286302208, + "anon": 245796864, + "anon_live": 245792768, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9113 + }, + { + "t": 499.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 275955712, + "peak": 286302208, + "anon": 245796864, + "anon_live": 245792768, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9400 + }, + { + "t": 514.6, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276557824, + "peak": 286302208, + "anon": 245800960, + "anon_live": 245796864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9682 + }, + { + "t": 529.8, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276566016, + "peak": 286302208, + "anon": 245800960, + "anon_live": 245796864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9965 + }, + { + "t": 544.9, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276131840, + "peak": 286302208, + "anon": 245800960, + "anon_live": 245796864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10251 + }, + { + "t": 560.1, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276426752, + "peak": 286302208, + "anon": 245800960, + "anon_live": 245796864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10535 + }, + { + "t": 575.2, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 276275200, + "peak": 286674944, + "anon": 246050816, + "anon_live": 246046720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10821 + }, + { + "t": 590.3, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 277770240, + "peak": 286674944, + "anon": 246726656, + "anon_live": 246722560, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11104 + }, + { + "t": 605.5, + "containers": { + "mealie": { + "limit": 1048576000, + "current": 277929984, + "peak": 287174656, + "anon": 246857728, + "anon_live": 246853632, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11386 + } +] \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/migration-lines.txt b/documentation/audits/security-2026-11-02/bench/mealie/migration-lines.txt new file mode 100644 index 00000000..62468978 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/migration-lines.txt @@ -0,0 +1,6 @@ +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:34:45 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:34:46 - Running upgrade 1e69ea7cd45e -> a91720b8a7e7, add ai prompt overrides +mealie | INFO 2026-11-02T23:34:46 - Running upgrade a91720b8a7e7 -> afdc42353aa4, Add duration in seconds to recipe steps. +mealie | INFO 2026-11-02T23:34:46 - Running upgrade afdc42353aa4 -> a9f823e9e441, 'add end_date to group meal plans' +mealie | INFO 2026-11-02T23:34:46 - Running upgrade a9f823e9e441 -> 071e03b4f851, 'backfill missing ai provider settings' \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/run.log b/documentation/audits/security-2026-11-02/bench/mealie/run.log new file mode 100644 index 00000000..b1690ef8 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/run.log @@ -0,0 +1,57 @@ +[22:32:46] scratch drive folders cleared before FROM (R-656): none existed +[22:32:46] MV-mealie: deploying mealie at FROM {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.29.0'} +[22:33:57] FROM settled=True in 31.0s :: {"mealie": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:33:57] fixture: the BOX walk's own (Mealie), through upgrade_boxport +[22:33:59] mealie: create recipe http=201 +[22:34:00] mealie: readback of the seeded recipe http=200 ok=True +[22:34:00] C1 (seed reads back BEFORE): True +[22:34:00] MV-mealie: swapping to TO {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.30.0'} +[22:34:39] TO up -d rc=0 +[22:35:10] TO settled=True in 30.9s :: {"mealie": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:35:10] migration lines observed: 6 +[22:35:12] mealie: readback of the seeded recipe http=200 ok=True +[22:35:12] RESULT (seed reads back AFTER): True +[22:35:12] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:9000 +[22:35:27] + 15s mealie=256M/1000M peak=257M kills=0 rs=0 reqs=278 +[22:35:42] + 30s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=561 +[22:35:57] + 45s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=843 +[22:36:13] + 60s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1129 +[22:36:28] + 76s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1412 +[22:36:43] + 91s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=1698 +[22:36:58] + 106s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=1981 +[22:37:13] + 121s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=2268 +[22:37:28] + 136s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=2550 +[22:37:43] + 151s mealie=257M/1000M peak=266M kills=0 rs=0 reqs=2837 +[22:37:58] + 166s mealie=256M/1000M peak=266M kills=0 rs=0 reqs=3125 +[22:38:14] + 182s mealie=256M/1000M peak=267M kills=0 rs=0 reqs=3411 +[22:38:29] + 197s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=3701 +[22:38:44] + 212s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=3987 +[22:38:59] + 227s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4273 +[22:39:14] + 242s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4561 +[22:39:29] + 257s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=4849 +[22:39:45] + 272s mealie=257M/1000M peak=267M kills=0 rs=0 reqs=5140 +[22:40:00] + 288s mealie=262M/1000M peak=267M kills=0 rs=0 reqs=5417 +[22:40:15] + 303s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=5699 +[22:40:30] + 318s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=5981 +[22:40:45] + 333s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6262 +[22:41:00] + 348s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6549 +[22:41:15] + 363s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=6831 +[22:41:31] + 378s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=7116 +[22:41:46] + 394s mealie=262M/1000M peak=272M kills=0 rs=0 reqs=7401 +[22:42:01] + 409s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=7683 +[22:42:16] + 424s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=7971 +[22:42:31] + 439s mealie=263M/1000M peak=272M kills=0 rs=0 reqs=8253 +[22:42:46] + 454s mealie=262M/1000M peak=273M kills=0 rs=0 reqs=8543 +[22:43:01] + 469s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=8830 +[22:43:16] + 484s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9113 +[22:43:32] + 500s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9400 +[22:43:47] + 515s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9682 +[22:44:02] + 530s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=9965 +[22:44:17] + 545s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10251 +[22:44:32] + 560s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10535 +[22:44:47] + 575s mealie=263M/1000M peak=273M kills=0 rs=0 reqs=10821 +[22:45:02] + 590s mealie=264M/1000M peak=273M kills=0 rs=0 reqs=11104 +[22:45:18] + 606s mealie=265M/1000M peak=273M kills=0 rs=0 reqs=11386 +[22:45:18] memory watch: killed=False tight=[] requests=11386 codes={'200': 11386} +[22:45:18] MV-mealie: ABORT — putting the FROM images back +[22:48:25] ABORT: the app did NOT come back (rc=0, 184.8s) \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/to-full.log b/documentation/audits/security-2026-11-02/bench/mealie/to-full.log new file mode 100644 index 00000000..10398bff --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/to-full.log @@ -0,0 +1,144 @@ +mealie | Switching to dedicated user +mealie | +mealie | User uid: 1000 +mealie | User gid: 1000 +mealie | +mealie | INFO 2026-11-02T23:34:45 - Started server process [1] +mealie | INFO 2026-11-02T23:34:45 - Waiting for application startup. +mealie | INFO 2026-11-02T23:34:45 - start: database initialization +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.schemas +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.tables +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.types +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.constraints +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.defaults +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.comments +mealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.ext.checkconstraint_byname +mealie | INFO 2026-11-02T23:34:45 - Database connection established. +mealie | INFO 2026-11-02T23:34:45 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:34:45 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:34:45 - Migration needed. Performing migration... +mealie | INFO 2026-11-02T23:34:45 - Context impl SQLiteImpl. +mealie | INFO 2026-11-02T23:34:45 - Will assume non-transactional DDL. +mealie | INFO 2026-11-02T23:34:46 - Running upgrade 1e69ea7cd45e -> a91720b8a7e7, add ai prompt overrides +mealie | INFO 2026-11-02T23:34:46 - Running upgrade a91720b8a7e7 -> afdc42353aa4, Add duration in seconds to recipe steps. +mealie | INFO 2026-11-02T23:34:46 - Running upgrade afdc42353aa4 -> a9f823e9e441, 'add end_date to group meal plans' +mealie | INFO 2026-11-02T23:34:46 - Running upgrade a9f823e9e441 -> 071e03b4f851, 'backfill missing ai provider settings' +mealie | INFO 2026-11-02T23:34:46 - Checking for migration data fixes +mealie | INFO 2026-11-02T23:34:46 - end: database initialization +mealie | INFO 2026-11-02T23:34:46 - -----SYSTEM STARTUP----- +mealie | INFO 2026-11-02T23:34:46 - ------APP SETTINGS------ +mealie | INFO 2026-11-02T23:34:46 - { +mealie | "TESTING": false, +mealie | "PRODUCTION": true, +mealie | "LOG_CONFIG_OVERRIDE": null, +mealie | "LOG_LEVEL": "info", +mealie | "theme": { +mealie | "light_primary": "#E58325", +mealie | "light_accent": "#007A99", +mealie | "light_secondary": "#973542", +mealie | "light_success": "#43A047", +mealie | "light_info": "#1976D2", +mealie | "light_warning": "#FF6D00", +mealie | "light_error": "#EF5350", +mealie | "dark_primary": "#E58325", +mealie | "dark_accent": "#007A99", +mealie | "dark_secondary": "#973542", +mealie | "dark_success": "#43A047", +mealie | "dark_info": "#1976D2", +mealie | "dark_warning": "#FF6D00", +mealie | "dark_error": "#EF5350" +mealie | }, +mealie | "branding": { +mealie | "name": "Mealie", +mealie | "logo_path": null +mealie | }, +mealie | "BASE_URL": "https://recipes.gate.invalid", +mealie | "STATIC_FILES": "/opt/mealie/lib/python3.14/site-packages/mealie/frontend", +mealie | "IS_DEMO": false, +mealie | "HOST_IP": "*", +mealie | "API_HOST": "", +mealie | "API_PORT": 9000, +mealie | "API_DOCS": true, +mealie | "TOKEN_TIME": 48, +mealie | "GIT_COMMIT_HASH": "9552df62118224a377d9c9b0a62706a62220ab86", +mealie | "ALLOW_SIGNUP": false, +mealie | "ALLOW_PASSWORD_LOGIN": true, +mealie | "ALLOWED_IFRAME_HOSTS": "", +mealie | "HTTP_ALLOW_LIST": "", +mealie | "HTTP_DISALLOW_LIST": "", +mealie | "DAILY_SCHEDULE_TIME": "23:45", +mealie | "SECURITY_MAX_LOGIN_ATTEMPTS": 5, +mealie | "SECURITY_USER_LOCKOUT_TIME": 1, +mealie | "DB_ENGINE": "sqlite", +mealie | "SQLITE_MIGRATE_JOURNAL_WAL": false, +mealie | "DEFAULT_GROUP": "Home", +mealie | "DEFAULT_HOUSEHOLD": "Family", +mealie | "SMTP_HOST": "", +mealie | "SMTP_PORT": "25", +mealie | "SMTP_FROM_NAME": "", +mealie | "SMTP_FROM_EMAIL": "", +mealie | "SMTP_USER": null, +mealie | "SMTP_PASSWORD": null, +mealie | "SMTP_AUTH_STRATEGY": "NONE", +mealie | "LDAP_AUTH_ENABLED": false, +mealie | "LDAP_SERVER_URL": null, +mealie | "LDAP_TLS_INSECURE": false, +mealie | "LDAP_TLS_CACERTFILE": null, +mealie | "LDAP_ENABLE_STARTTLS": false, +mealie | "LDAP_BASE_DN": null, +mealie | "LDAP_QUERY_BIND": null, +mealie | "LDAP_QUERY_PASSWORD": null, +mealie | "LDAP_USER_FILTER": null, +mealie | "LDAP_ADMIN_FILTER": null, +mealie | "LDAP_ID_ATTRIBUTE": "uid", +mealie | "LDAP_MAIL_ATTRIBUTE": "mail", +mealie | "LDAP_NAME_ATTRIBUTE": "name", +mealie | "OIDC_AUTH_ENABLED": false, +mealie | "OIDC_CLIENT_ID": null, +mealie | "OIDC_CLIENT_SECRET": null, +mealie | "OIDC_CONFIGURATION_URL": null, +mealie | "OIDC_SIGNUP_ENABLED": true, +mealie | "OIDC_REQUIRES_EMAIL_VERIFICATION": true, +mealie | "OIDC_USER_GROUP": null, +mealie | "OIDC_ADMIN_GROUP": null, +mealie | "OIDC_AUTO_REDIRECT": false, +mealie | "OIDC_PROVIDER_NAME": "OAuth", +mealie | "OIDC_REMEMBER_ME": false, +mealie | "OIDC_USER_CLAIM": "email", +mealie | "OIDC_NAME_CLAIM": "name", +mealie | "OIDC_GROUPS_CLAIM": "groups", +mealie | "OIDC_SCOPES_OVERRIDE": null, +mealie | "OIDC_TLS_CACERTFILE": null, +mealie | "OIDC_VERIFY_X509_STRICT": true, +mealie | "OIDC_CLIENT_TIMEOUT": "default", +mealie | "OIDC_NATIVE_CLIENT_ID": null, +mealie | "OIDC_NATIVE_CONFIDENTIAL": true, +mealie | "REVERSE_PROXY_AUTH_ENABLED": false, +mealie | "REVERSE_PROXY_AUTH_HEADER": "X-Forwarded-User", +mealie | "REVERSE_PROXY_AUTH_SIGNUP_ENABLED": false, +mealie | "REVERSE_PROXY_AUTH_SECRET": null, +mealie | "REVERSE_PROXY_AUTH_SECRET_HEADER": "X-Mealie-Reverse-Proxy-Secret", +mealie | "SCRAPER_PROXY_URL": null, +mealie | "SCRAPER_PROXY_MODE": "always", +mealie | "SCRAPER_FLARESOLVERR_URL": null, +mealie | "SCRAPER_FLARESOLVERR_TIMEOUT": 60, +mealie | "WORKER_PER_CORE": 1, +mealie | "UVICORN_WORKERS": 1, +mealie | "TLS_CERTIFICATE_PATH": null, +mealie | "TLS_PRIVATE_KEY_PATH": null, +mealie | "YTDLP_COOKIEFILE": null +mealie | } +mealie | INFO 2026-11-02T23:34:46 - ------APP FEATURES------ +mealie | INFO 2026-11-02T23:34:46 - --------==SMTP==-------- +mealie | INFO 2026-11-02T23:34:46 - Enabled: False +mealie | Reason: Missing required values for ['SMTP_HOST', 'SMTP_FROM_NAME', 'SMTP_FROM_EMAIL'] +mealie | INFO 2026-11-02T23:34:46 - --------==LDAP==-------- +mealie | INFO 2026-11-02T23:34:46 - Enabled: False +mealie | Reason: LDAP_AUTH_ENABLED is false +mealie | INFO 2026-11-02T23:34:46 - --------==OIDC==-------- +mealie | INFO 2026-11-02T23:34:46 - Enabled: False +mealie | Reason: OIDC_AUTH_ENABLED is false +mealie | INFO 2026-11-02T23:34:46 - ------------------------ +mealie | INFO 2026-11-02T23:34:46 - Daily tasks scheduled for 2026-11-02 22:45:00+00:00 +mealie | INFO 2026-11-02T23:34:46 - Application startup complete. +mealie | INFO 2026-11-02T23:34:46 - Uvicorn running on socket ('::', 9000, 0, 0) (Press CTRL+C to quit) diff --git a/documentation/audits/security-2026-11-02/bench/mealie/to-states.json b/documentation/audits/security-2026-11-02/bench/mealie/to-states.json new file mode 100644 index 00000000..b0082e1a --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/to-states.json @@ -0,0 +1,8 @@ +{ + "mealie": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/mealie/verdict.json b/documentation/audits/security-2026-11-02/bench/mealie/verdict.json new file mode 100644 index 00000000..54476fe1 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/mealie/verdict.json @@ -0,0 +1,58 @@ +{ + "harness_version": 5, + "edge": "MV-mealie", + "app": "mealie", + "note": "night 2026-09-23 within-a-major move: mealie=ghcr.io/mealie-recipes/mealie:v3.30.0", + "from": { + "mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0" + }, + "to": { + "mealie": "ghcr.io/mealie-recipes/mealie:v3.30.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kmealie | INFO 2026-11-02T23:34:45 - setup plugin alembic.autogenerate.schemas", + "abort": "refuses", + "abort_detail": "ncestor=\"Destination %(end)s is not a valid upgrade \"\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | \"target from current head(s)\",\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | end=destination,\n\u001b[2Kmealie | ^^^^^^^^^^^^^^^^\n\u001b[2Kmealie | ):\n\u001b[2Kmealie | ^\n\u001b[2Kmealie | File \"/usr/local/lib/python3.14/contextlib.py\", line 162, in __exit__\n\u001b[2Kmealie | self.gen.throw(value)\n\u001b[2Kmealie | ~~~~~~~~~~~~~~^^^^^^^\n\u001b[2Kmealie | File \"/opt/mealie/lib/python3.14/site-packages/alembic/script/base.py\", line 239, in _catch_revision_errors\n\u001b[2Kmealie | raise util.CommandError(resolution) from re\n\u001b[2Kmealie | alembic.util.exc.CommandError: Can't locate revision identified by '071e03b4f851'\n\u001b[2Kmealie | \n\u001b[2Kmealie | ERROR 2026-11-02T23:47:37 - Application startup failed. Exiting.", + "engine_state_after": null, + "memory": { + "soak_s": 605.6, + "requested_s": 600, + "requests": 11386, + "codes": { + "200": 11386 + }, + "first_kill": null, + "containers": { + "mealie": { + "limit": 1048576000, + "peak": 287174656, + "peak_pct": 0.274, + "anon_peak_sampled": 246857728, + "anon_peak_pct": 0.235, + "anon_live_peak_sampled": 246853632, + "anon_live_peak_pct": 0.235, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-11-02T22:48:25Z", + "evidence": "evidence/MV-mealie", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 938.8 +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/MV-paperless-ngx.log b/documentation/audits/security-2026-11-02/bench/paperless-ngx/MV-paperless-ngx.log new file mode 100644 index 00000000..acd293c5 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/MV-paperless-ngx.log @@ -0,0 +1,156 @@ +[23:00:41] scratch drive folders cleared before FROM (R-656): none existed +[23:00:41] MV-paperless-ngx: deploying paperless-ngx at FROM {'paperless-webserver': 'ghcr.io/paperless-ngx/paperless-ngx:2.20.15', 'paperless-postgres': 'postgres:18-alpine', 'paperless-redis': 'redis:7-alpine'} +[23:02:49] FROM settled=True in 62.5s :: {"paperless-postgres": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-redis": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-webserver": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[23:02:49] fixture: the BOX walk's own (Django), through upgrade_boxport +[23:02:56] paperless-webserver: createsuperuser :: Superuser created successfully. +[23:03:02] paperless-webserver: seeded superuser drillfceaae +[23:03:12] paperless-webserver: readback of the seeded account found=True +[23:03:12] C1 (seed reads back BEFORE): True +[23:03:13] MV-paperless-ngx: swapping to TO {'paperless-webserver': 'ghcr.io/paperless-ngx/paperless-ngx:3.4.1', 'paperless-postgres': 'postgres:18-alpine', 'paperless-redis': 'redis:7-alpine'} +[23:04:37] TO up -d rc=0 +[23:05:39] TO settled=True in 62.4s :: {"paperless-postgres": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-redis": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-webserver": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[23:05:39] engine state paperless-postgres: 18 +[23:05:39] migration lines observed: 6 +[23:05:47] paperless-webserver: readback of the seeded account found=True +[23:05:47] RESULT (seed reads back AFTER): True +[23:05:48] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8000 +[23:06:03] + 15s paperless-postgres=61M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=297 +[23:06:18] + 30s paperless-postgres=63M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=594 +[23:06:33] + 46s paperless-postgres=61M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=890 +[23:06:49] + 61s paperless-postgres=63M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1186 +[23:07:04] + 76s paperless-postgres=64M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1482 +[23:07:19] + 91s paperless-postgres=67M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1778 +[23:07:34] + 106s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=2074 +[23:07:49] + 121s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2370 +[23:08:04] + 137s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2667 +[23:08:20] + 152s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2966 +[23:08:35] + 167s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=3262 +[23:08:50] + 182s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=3558 +[23:09:05] + 197s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=3854 +[23:09:20] + 212s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=4150 +[23:09:36] + 228s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=4446 +[23:09:51] + 243s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=4742 +[23:10:06] + 258s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5042 +[23:10:21] + 273s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5338 +[23:10:36] + 288s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5634 +[23:10:51] + 304s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5930 +[23:11:07] + 319s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6226 +[23:11:22] + 334s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6522 +[23:11:37] + 349s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6818 +[23:11:52] + 364s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=7114 +[23:12:07] + 380s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=7410 +[23:12:23] + 395s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=7707 +[23:12:38] + 410s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8006 +[23:12:53] + 425s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8302 +[23:13:08] + 440s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8598 +[23:13:23] + 456s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8894 +[23:13:38] + 471s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9190 +[23:13:54] + 486s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9486 +[23:14:09] + 501s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9782 +[23:14:24] + 516s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10078 +[23:14:39] + 531s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10375 +[23:14:54] + 547s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10674 +[23:15:10] + 562s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10970 +[23:15:25] + 577s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=11266 +[23:15:40] + 592s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=11562 +[23:15:55] + 607s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=11858 +[23:15:55] memory watch: killed=False tight=[] requests=11858 codes={'302': 11858} +[23:15:55] MV-paperless-ngx: ABORT — putting the FROM images back +[23:19:06] ABORT: the app did NOT come back (rc=0, 181.2s) +{ + "harness_version": 5, + "edge": "MV-paperless-ngx", + "app": "paperless-ngx", + "note": "night 2026-09-23 within-a-major move: paperless-webserver=ghcr.io/paperless-ngx/paperless-ngx:3.4.1", + "from": { + "paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:2.20.15", + "paperless-postgres": "postgres:18-alpine", + "paperless-redis": "redis:7-alpine" + }, + "to": { + "paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:3.4.1", + "paperless-postgres": "postgres:18-alpine", + "paperless-redis": "redis:7-alpine" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kpaperless-webserver | [init-migrations] Apply database migrations...", + "abort": "refuses", + "abort_detail": "m is ready to accept connections\n\u001b[2Kpaperless-postgres | 2026-11-03 00:06:38.951 CET [65] LOG: checkpoint starting: time\n\u001b[2Kpaperless-postgres | 2026-11-03 00:07:35.808 CET [65] LOG: checkpoint complete: wrote 568 buffers (3.5%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 1 recycled; write=56.737 s, sync=0.092 s, total=56.858 s; sync files=983, longest=0.003 s, average=0.001 s; distance=6068 kB, estimate=6068 kB; lsn=0/2195960, redo lsn=0/21958D0\n\u001b[2Kpaperless-postgres | 2026-11-03 00:16:39.005 CET [65] LOG: checkpoint starting: time\n\u001b[2Kpaperless-postgres | 2026-11-03 00:16:41.345 CET [65] LOG: checkpoint complete: wrote 23 buffers (0.1%), wrote 1 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=2.308 s, sync=0.015 s, total=2.341 s; sync files=22, longest=0.012 s, average=0.001 s; distance=46 kB, estimate=5465 kB; lsn=0/21A1430, redo lsn=0/21A13D8", + "engine_state_after": { + "paperless-postgres": { + "image": "postgres:18-alpine", + "probe": "datadir major version", + "answer": "18", + "probe_rc": 0 + } + }, + "memory": { + "soak_s": 607.6, + "requested_s": 600, + "requests": 11858, + "codes": { + "302": 11858 + }, + "first_kill": null, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "peak": 184569856, + "peak_pct": 0.688, + "anon_peak_sampled": 8581120, + "anon_peak_pct": 0.032, + "anon_live_peak_sampled": 8581120, + "anon_live_peak_pct": 0.032, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "paperless-redis": { + "limit": 134217728, + "peak": 10706944, + "peak_pct": 0.08, + "anon_peak_sampled": 3092480, + "anon_peak_pct": 0.023, + "anon_live_peak_sampled": 3092480, + "anon_live_peak_pct": 0.023, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "paperless-webserver": { + "limit": 1342177280, + "peak": 959496192, + "peak_pct": 0.715, + "anon_peak_sampled": 544321536, + "anon_peak_pct": 0.406, + "anon_live_peak_sampled": 544301056, + "anon_live_peak_pct": 0.406, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 62.4, + "measured_at": "2026-11-02T23:19:06Z", + "evidence": "evidence/MV-paperless-ngx", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 1104.6 +} diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-refusal.txt b/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-refusal.txt new file mode 100644 index 00000000..e41b0a7d --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-refusal.txt @@ -0,0 +1,88 @@ +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-postgres | syncing data to disk ... ok +paperless-postgres | +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-postgres | +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-postgres | Success. You can now start the database server using: +paperless-postgres | +paperless-postgres | pg_ctl -D /var/lib/postgresql/18/docker -l logfile start +paperless-postgres | +paperless-postgres | waiting for server to start....2026-11-03 00:01:38.373 CET [45] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-postgres | 2026-11-03 00:01:38.376 CET [45] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. +paperless-postgres | 2026-11-03 00:01:38.390 CET [51] LOG: database system was shut down at 2026-11-03 00:01:37 CET +paperless-postgres | 2026-11-03 00:01:38.399 CET [45] LOG: database system is ready to accept connections +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Redis version=7.4.12, bits=64, commit=00000000, modified=0, pid=1, just started +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Configuration loaded +paperless-redis | 1:M 03 Nov 2026 00:01:36.665 * monotonic clock: POSIX clock_gettime +paperless-redis | 1:M 03 Nov 2026 00:01:36.666 * Running mode=standalone, port=6379. +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Server initialized +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Ready to accept connections tcp +paperless-postgres | done +paperless-postgres | server started +paperless-postgres | CREATE DATABASE +paperless-postgres | +paperless-postgres | +paperless-postgres | /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/* +paperless-postgres | +paperless-postgres | waiting for server to shut down....2026-11-03 00:01:38.597 CET [45] LOG: received fast shutdown request +paperless-postgres | 2026-11-03 00:01:38.601 CET [45] LOG: aborting any active transactions +paperless-postgres | 2026-11-03 00:01:38.604 CET [45] LOG: background worker "logical replication launcher" (PID 54) exited with exit code 1 +paperless-postgres | 2026-11-03 00:01:38.604 CET [49] LOG: shutting down +paperless-postgres | 2026-11-03 00:01:38.607 CET [49] LOG: checkpoint starting: shutdown immediate +paperless-postgres | 2026-11-03 00:01:38.749 CET [49] LOG: checkpoint complete: wrote 943 buffers (5.8%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=0.024 s, sync=0.105 s, total=0.145 s; sync files=303, longest=0.073 s, average=0.001 s; distance=4362 kB, estimate=4362 kB; lsn=0/1BA8868, redo lsn=0/1BA8868 +paperless-postgres | 2026-11-03 00:01:38.775 CET [45] LOG: database system is shut down +paperless-postgres | done +paperless-postgres | server stopped +paperless-postgres | +paperless-postgres | PostgreSQL init process complete; ready for start up. +paperless-postgres | +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv4 address "0.0.0.0", port 5432 +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv6 address "::", port 5432 +paperless-postgres | 2026-11-03 00:01:38.850 CET [1] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-postgres | 2026-11-03 00:01:38.861 CET [67] LOG: database system was shut down at 2026-11-03 00:01:38 CET +paperless-postgres | 2026-11-03 00:01:38.870 CET [1] LOG: database system is ready to accept connections +paperless-postgres | 2026-11-03 00:06:38.951 CET [65] LOG: checkpoint starting: time +paperless-postgres | 2026-11-03 00:07:35.808 CET [65] LOG: checkpoint complete: wrote 568 buffers (3.5%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 1 recycled; write=56.737 s, sync=0.092 s, total=56.858 s; sync files=983, longest=0.003 s, average=0.001 s; distance=6068 kB, estimate=6068 kB; lsn=0/2195960, redo lsn=0/21958D0 +paperless-postgres | 2026-11-03 00:16:39.005 CET [65] LOG: checkpoint starting: time +paperless-postgres | 2026-11-03 00:16:41.345 CET [65] LOG: checkpoint complete: wrote 23 buffers (0.1%), wrote 1 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=2.308 s, sync=0.015 s, total=2.341 s; sync files=22, longest=0.012 s, average=0.001 s; distance=46 kB, estimate=5465 kB; lsn=0/21A1430, redo lsn=0/21A13D8 \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-states.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-states.json new file mode 100644 index 00000000..cb8da212 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/abort-states.json @@ -0,0 +1,20 @@ +{ + "paperless-postgres": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "paperless-redis": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "paperless-webserver": { + "status": "restarting", + "health": "unhealthy", + "restarts": 0, + "exit": 1 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/compose-final.log b/documentation/audits/security-2026-11-02/bench/paperless-ngx/compose-final.log new file mode 100644 index 00000000..d9fc8acc --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/compose-final.log @@ -0,0 +1,523 @@ +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Redis version=7.4.12, bits=64, commit=00000000, modified=0, pid=1, just started +paperless-postgres | The files belonging to this database system will be owned by user "postgres". +paperless-postgres | This user must also own the server process. +paperless-postgres | +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Configuration loaded +paperless-redis | 1:M 03 Nov 2026 00:01:36.665 * monotonic clock: POSIX clock_gettime +paperless-redis | 1:M 03 Nov 2026 00:01:36.666 * Running mode=standalone, port=6379. +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Server initialized +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Ready to accept connections tcp +paperless-postgres | The database cluster will be initialized with locale "en_US.utf8". +paperless-postgres | The default database encoding has accordingly been set to "UTF8". +paperless-postgres | The default text search configuration will be set to "english". +paperless-postgres | +paperless-postgres | Data page checksums are enabled. +paperless-postgres | +paperless-postgres | fixing permissions on existing directory /var/lib/postgresql/18/docker ... ok +paperless-postgres | creating subdirectories ... ok +paperless-postgres | selecting dynamic shared memory implementation ... posix +paperless-postgres | selecting default "max_connections" ... 100 +paperless-postgres | selecting default "shared_buffers" ... 128MB +paperless-postgres | selecting default time zone ... Europe/Budapest +paperless-postgres | creating configuration files ... ok +paperless-postgres | running bootstrap script ... ok +paperless-postgres | sh: locale: not found +paperless-postgres | 2026-11-03 00:01:37.258 CET [39] WARNING: no usable system locales were found +paperless-postgres | performing post-bootstrap initialization ... ok +paperless-postgres | initdb: warning: enabling "trust" authentication for local connections +paperless-postgres | initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb. +paperless-postgres | syncing data to disk ... ok +paperless-postgres | +paperless-postgres | +paperless-postgres | Success. You can now start the database server using: +paperless-postgres | +paperless-postgres | pg_ctl -D /var/lib/postgresql/18/docker -l logfile start +paperless-postgres | +paperless-postgres | waiting for server to start....2026-11-03 00:01:38.373 CET [45] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-postgres | 2026-11-03 00:01:38.376 CET [45] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-postgres | 2026-11-03 00:01:38.390 CET [51] LOG: database system was shut down at 2026-11-03 00:01:37 CET +paperless-postgres | 2026-11-03 00:01:38.399 CET [45] LOG: database system is ready to accept connections +paperless-postgres | done +paperless-postgres | server started +paperless-postgres | CREATE DATABASE +paperless-postgres | +paperless-postgres | +paperless-postgres | /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/* +paperless-postgres | +paperless-postgres | waiting for server to shut down....2026-11-03 00:01:38.597 CET [45] LOG: received fast shutdown request +paperless-postgres | 2026-11-03 00:01:38.601 CET [45] LOG: aborting any active transactions +paperless-postgres | 2026-11-03 00:01:38.604 CET [45] LOG: background worker "logical replication launcher" (PID 54) exited with exit code 1 +paperless-postgres | 2026-11-03 00:01:38.604 CET [49] LOG: shutting down +paperless-postgres | 2026-11-03 00:01:38.607 CET [49] LOG: checkpoint starting: shutdown immediate +paperless-postgres | 2026-11-03 00:01:38.749 CET [49] LOG: checkpoint complete: wrote 943 buffers (5.8%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=0.024 s, sync=0.105 s, total=0.145 s; sync files=303, longest=0.073 s, average=0.001 s; distance=4362 kB, estimate=4362 kB; lsn=0/1BA8868, redo lsn=0/1BA8868 +paperless-postgres | 2026-11-03 00:01:38.775 CET [45] LOG: database system is shut down +paperless-postgres | done +paperless-postgres | server stopped +paperless-postgres | +paperless-postgres | PostgreSQL init process complete; ready for start up. +paperless-postgres | +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv4 address "0.0.0.0", port 5432 +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv6 address "::", port 5432 +paperless-postgres | 2026-11-03 00:01:38.850 CET [1] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-postgres | 2026-11-03 00:01:38.861 CET [67] LOG: database system was shut down at 2026-11-03 00:01:38 CET +paperless-postgres | 2026-11-03 00:01:38.870 CET [1] LOG: database system is ready to accept connections +paperless-postgres | 2026-11-03 00:06:38.951 CET [65] LOG: checkpoint starting: time +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-postgres | 2026-11-03 00:07:35.808 CET [65] LOG: checkpoint complete: wrote 568 buffers (3.5%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 1 recycled; write=56.737 s, sync=0.092 s, total=56.858 s; sync files=983, longest=0.003 s, average=0.001 s; distance=6068 kB, estimate=6068 kB; lsn=0/2195960, redo lsn=0/21958D0 +paperless-postgres | 2026-11-03 00:16:39.005 CET [65] LOG: checkpoint starting: time +paperless-postgres | 2026-11-03 00:16:41.345 CET [65] LOG: checkpoint complete: wrote 23 buffers (0.1%), wrote 1 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=2.308 s, sync=0.015 s, total=2.341 s; sync files=22, longest=0.012 s, average=0.001 s; distance=46 kB, estimate=5465 kB; lsn=0/21A1430, redo lsn=0/21A13D8 +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | mkdir: created directory '/tmp/paperless' +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | changed ownership of '/tmp/paperless' from root:root to paperless:paperless +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | [init-tesseract-langs] Installing package tesseract-ocr-hun... +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | [init-tesseract-langs] Installed tesseract-ocr-hun +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | Installing languages... +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-webserver | [env-init] No *_FILE environment found +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-hun already installed! +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-webserver | Traceback (most recent call last): +paperless-webserver | File "/usr/src/paperless/src/manage.py", line 10, in +paperless-webserver | execute_from_command_line(sys.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line +paperless-webserver | utility.execute() +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/__init__.py", line 436, in execute +paperless-webserver | self.fetch_command(subcommand).run_from_argv(self.argv) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 416, in run_from_argv +paperless-webserver | self.execute(*args, **cmd_options) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 460, in execute +paperless-webserver | output = self.handle(*args, **options) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/base.py", line 107, in wrapper +paperless-webserver | res = handle_func(*args, **kwargs) +paperless-webserver | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/core/management/commands/migrate.py", line 117, in handle +paperless-webserver | executor.loader.check_consistent_history(connection) +paperless-webserver | File "/usr/local/lib/python3.12/site-packages/django/db/migrations/loader.py", line 327, in check_consistent_history +paperless-webserver | raise InconsistentMigrationHistory( +paperless-webserver | django.db.migrations.exceptions.InconsistentMigrationHistory: Migration documents.1022_paperlesstask_squashed_1036_alter_savedviewfilterrule_rule_type is applied before its dependency django_celery_results.0011_taskresult_periodic_task_name on database 'default'. +paperless-webserver | s6-rc: warning: unable to start service init-migrations: command exited 1 +paperless-webserver | /run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information. +paperless-webserver | /run/s6/basedir/scripts/rc.init: fatal: stopping the container. diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/engine-state.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/engine-state.json new file mode 100644 index 00000000..85bd6d8d --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/engine-state.json @@ -0,0 +1,8 @@ +{ + "paperless-postgres": { + "image": "postgres:18-alpine", + "probe": "datadir major version", + "answer": "18", + "probe_rc": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after-detail.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after-detail.json new file mode 100644 index 00000000..482b307e --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after-detail.json @@ -0,0 +1,7 @@ +{ + "/srv/felhom-gate/hdd/appdata/paperless/export": {}, + "/srv/felhom-gate/hdd/appdata/paperless/media": { + "media.lock": "0:e3b0c44298fc1c14" + }, + "/srv/felhom-gate/import/paperless": {} +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after.json new file mode 100644 index 00000000..4be56307 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-after.json @@ -0,0 +1,5 @@ +{ + "/srv/felhom-gate/hdd/appdata/paperless/export": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "/srv/felhom-gate/hdd/appdata/paperless/media": "3d56384a871d4d286ff78c003cf877c8708bf525f82961a087edae6d911d4506", + "/srv/felhom-gate/import/paperless": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before-detail.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before-detail.json new file mode 100644 index 00000000..482b307e --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before-detail.json @@ -0,0 +1,7 @@ +{ + "/srv/felhom-gate/hdd/appdata/paperless/export": {}, + "/srv/felhom-gate/hdd/appdata/paperless/media": { + "media.lock": "0:e3b0c44298fc1c14" + }, + "/srv/felhom-gate/import/paperless": {} +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before.json new file mode 100644 index 00000000..4be56307 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/files-before.json @@ -0,0 +1,5 @@ +{ + "/srv/felhom-gate/hdd/appdata/paperless/export": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "/srv/felhom-gate/hdd/appdata/paperless/media": "3d56384a871d4d286ff78c003cf877c8708bf525f82961a087edae6d911d4506", + "/srv/felhom-gate/import/paperless": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/memory-samples.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/memory-samples.json new file mode 100644 index 00000000..86be9443 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/memory-samples.json @@ -0,0 +1,1922 @@ +[ + { + "t": 15.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 64282624, + "peak": 184569856, + "anon": 7229440, + "anon_live": 7229440, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7553024, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860573696, + "peak": 959496192, + "anon": 544030720, + "anon_live": 544010240, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 297 + }, + { + "t": 30.4, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 66117632, + "peak": 184569856, + "anon": 8581120, + "anon_live": 8581120, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7041024, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859742208, + "peak": 959496192, + "anon": 544038912, + "anon_live": 544018432, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 594 + }, + { + "t": 45.6, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 64282624, + "peak": 184569856, + "anon": 7229440, + "anon_live": 7229440, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7565312, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860459008, + "peak": 959496192, + "anon": 544047104, + "anon_live": 544026624, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 890 + }, + { + "t": 60.7, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 66121728, + "peak": 184569856, + "anon": 7393280, + "anon_live": 7393280, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860217344, + "peak": 959496192, + "anon": 544071680, + "anon_live": 544051200, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1186 + }, + { + "t": 75.9, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 68141056, + "peak": 184569856, + "anon": 7405568, + "anon_live": 7405568, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860106752, + "peak": 959496192, + "anon": 544223232, + "anon_live": 544202752, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1482 + }, + { + "t": 91.1, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 70635520, + "peak": 184569856, + "anon": 7417856, + "anon_live": 7417856, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7823360, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859983872, + "peak": 959496192, + "anon": 544251904, + "anon_live": 544231424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1778 + }, + { + "t": 106.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 72282112, + "peak": 184569856, + "anon": 7454720, + "anon_live": 7454720, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859471872, + "peak": 959496192, + "anon": 544247808, + "anon_live": 544227328, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2074 + }, + { + "t": 121.4, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7561216, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860413952, + "peak": 959496192, + "anon": 544231424, + "anon_live": 544210944, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2370 + }, + { + "t": 136.6, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860712960, + "peak": 959496192, + "anon": 544243712, + "anon_live": 544223232, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2667 + }, + { + "t": 151.8, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71712768, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859938816, + "peak": 959496192, + "anon": 544247808, + "anon_live": 544227328, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2966 + }, + { + "t": 167.0, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860364800, + "peak": 959496192, + "anon": 544223232, + "anon_live": 544202752, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3262 + }, + { + "t": 182.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7565312, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860499968, + "peak": 959496192, + "anon": 544272384, + "anon_live": 544251904, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3558 + }, + { + "t": 197.3, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7299072, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859734016, + "peak": 959496192, + "anon": 544251904, + "anon_live": 544231424, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3854 + }, + { + "t": 212.5, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71712768, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7303168, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860028928, + "peak": 959496192, + "anon": 544215040, + "anon_live": 544194560, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4150 + }, + { + "t": 227.7, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7041024, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859447296, + "peak": 959496192, + "anon": 544227328, + "anon_live": 544206848, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4446 + }, + { + "t": 242.9, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7041024, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859484160, + "peak": 959496192, + "anon": 544256000, + "anon_live": 544235520, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4742 + }, + { + "t": 258.1, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7565312, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860626944, + "peak": 959496192, + "anon": 544260096, + "anon_live": 544239616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5042 + }, + { + "t": 273.3, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71774208, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7299072, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860286976, + "peak": 959496192, + "anon": 544296960, + "anon_live": 544276480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5338 + }, + { + "t": 288.4, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7299072, + "peak": 10698752, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860348416, + "peak": 959496192, + "anon": 544284672, + "anon_live": 544264192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5634 + }, + { + "t": 303.6, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7561216, + "peak": 10706944, + "anon": 3092480, + "anon_live": 3092480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860254208, + "peak": 959496192, + "anon": 544321536, + "anon_live": 544301056, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5930 + }, + { + "t": 318.8, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7561216, + "peak": 10706944, + "anon": 3088384, + "anon_live": 3088384, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860184576, + "peak": 959496192, + "anon": 544268288, + "anon_live": 544247808, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6226 + }, + { + "t": 334.0, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7528448, + "peak": 10706944, + "anon": 3055616, + "anon_live": 3055616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860033024, + "peak": 959496192, + "anon": 544317440, + "anon_live": 544296960, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6522 + }, + { + "t": 349.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7266304, + "peak": 10706944, + "anon": 3055616, + "anon_live": 3055616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859983872, + "peak": 959496192, + "anon": 544288768, + "anon_live": 544268288, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6818 + }, + { + "t": 364.3, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71708672, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7266304, + "peak": 10706944, + "anon": 3055616, + "anon_live": 3055616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859774976, + "peak": 959496192, + "anon": 544313344, + "anon_live": 544292864, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7114 + }, + { + "t": 379.5, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7548928, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859279360, + "peak": 959496192, + "anon": 543866880, + "anon_live": 543846400, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7410 + }, + { + "t": 394.7, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7290880, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859930624, + "peak": 959496192, + "anon": 543928320, + "anon_live": 543907840, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7707 + }, + { + "t": 409.9, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7553024, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859893760, + "peak": 959496192, + "anon": 543924224, + "anon_live": 543903744, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8006 + }, + { + "t": 425.1, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7290880, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859893760, + "peak": 959496192, + "anon": 543948800, + "anon_live": 543928320, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8302 + }, + { + "t": 440.3, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7032832, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859942912, + "peak": 959496192, + "anon": 543969280, + "anon_live": 543948800, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8598 + }, + { + "t": 455.5, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7815168, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860196864, + "peak": 959496192, + "anon": 543981568, + "anon_live": 543961088, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8894 + }, + { + "t": 470.7, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7553024, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860372992, + "peak": 959496192, + "anon": 544157696, + "anon_live": 544137216, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9190 + }, + { + "t": 485.9, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71921664, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7553024, + "peak": 10706944, + "anon": 3080192, + "anon_live": 3080192, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859885568, + "peak": 959496192, + "anon": 544141312, + "anon_live": 544120832, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9486 + }, + { + "t": 501.0, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71917568, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7286784, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860229632, + "peak": 959496192, + "anon": 544133120, + "anon_live": 544112640, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9782 + }, + { + "t": 516.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7286784, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859914240, + "peak": 959496192, + "anon": 544088064, + "anon_live": 544067584, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10078 + }, + { + "t": 531.4, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7548928, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860098560, + "peak": 959496192, + "anon": 544108544, + "anon_live": 544088064, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10375 + }, + { + "t": 546.6, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7548928, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860528640, + "peak": 959496192, + "anon": 544059392, + "anon_live": 544038912, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10674 + }, + { + "t": 561.8, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71786496, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7548928, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860221440, + "peak": 959496192, + "anon": 544124928, + "anon_live": 544104448, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10970 + }, + { + "t": 577.0, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7286784, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 860020736, + "peak": 959496192, + "anon": 544079872, + "anon_live": 544059392, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11266 + }, + { + "t": 592.2, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7286784, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859783168, + "peak": 959496192, + "anon": 544120832, + "anon_live": 544100352, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11562 + }, + { + "t": 607.3, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "current": 71782400, + "peak": 184569856, + "anon": 7573504, + "anon_live": 7573504, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-redis": { + "limit": 134217728, + "current": 7024640, + "peak": 10706944, + "anon": 3076096, + "anon_live": 3076096, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + }, + "paperless-webserver": { + "limit": 1342177280, + "current": 859783168, + "peak": 959496192, + "anon": 544104448, + "anon_live": 544083968, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11858 + } +] \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/migration-lines.txt b/documentation/audits/security-2026-11-02/bench/paperless-ngx/migration-lines.txt new file mode 100644 index 00000000..6f318847 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/migration-lines.txt @@ -0,0 +1,6 @@ +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | Apply all migrations: account, admin, auditlog, auth, authtoken, contenttypes, documents, guardian, mfa, paperless, paperless_mail, sessions, socialaccount +paperless-webserver | Running migrations: +paperless-webserver | Applying documents.0003_remove_document_storage_type... OK +paperless-webserver | Applying documents.0004_workflowtrigger_filter_has_any_correspondents_and_more... OK +paperless-webserver | Applying documents.0005_alter_document_checksum_unique... OK \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/run.log b/documentation/audits/security-2026-11-02/bench/paperless-ngx/run.log new file mode 100644 index 00000000..b343dbc9 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/run.log @@ -0,0 +1,59 @@ +[23:00:41] scratch drive folders cleared before FROM (R-656): none existed +[23:00:41] MV-paperless-ngx: deploying paperless-ngx at FROM {'paperless-webserver': 'ghcr.io/paperless-ngx/paperless-ngx:2.20.15', 'paperless-postgres': 'postgres:18-alpine', 'paperless-redis': 'redis:7-alpine'} +[23:02:49] FROM settled=True in 62.5s :: {"paperless-postgres": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-redis": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-webserver": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[23:02:49] fixture: the BOX walk's own (Django), through upgrade_boxport +[23:02:56] paperless-webserver: createsuperuser :: Superuser created successfully. +[23:03:02] paperless-webserver: seeded superuser drillfceaae +[23:03:12] paperless-webserver: readback of the seeded account found=True +[23:03:12] C1 (seed reads back BEFORE): True +[23:03:13] MV-paperless-ngx: swapping to TO {'paperless-webserver': 'ghcr.io/paperless-ngx/paperless-ngx:3.4.1', 'paperless-postgres': 'postgres:18-alpine', 'paperless-redis': 'redis:7-alpine'} +[23:04:37] TO up -d rc=0 +[23:05:39] TO settled=True in 62.4s :: {"paperless-postgres": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-redis": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}, "paperless-webserver": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[23:05:39] engine state paperless-postgres: 18 +[23:05:39] migration lines observed: 6 +[23:05:47] paperless-webserver: readback of the seeded account found=True +[23:05:47] RESULT (seed reads back AFTER): True +[23:05:48] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8000 +[23:06:03] + 15s paperless-postgres=61M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=297 +[23:06:18] + 30s paperless-postgres=63M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=594 +[23:06:33] + 46s paperless-postgres=61M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=890 +[23:06:49] + 61s paperless-postgres=63M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1186 +[23:07:04] + 76s paperless-postgres=64M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1482 +[23:07:19] + 91s paperless-postgres=67M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=1778 +[23:07:34] + 106s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=2074 +[23:07:49] + 121s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2370 +[23:08:04] + 137s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2667 +[23:08:20] + 152s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=2966 +[23:08:35] + 167s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=3262 +[23:08:50] + 182s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=3558 +[23:09:05] + 197s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=3854 +[23:09:20] + 212s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=4150 +[23:09:36] + 228s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=4446 +[23:09:51] + 243s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=4742 +[23:10:06] + 258s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5042 +[23:10:21] + 273s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5338 +[23:10:36] + 288s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5634 +[23:10:51] + 304s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=5930 +[23:11:07] + 319s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6226 +[23:11:22] + 334s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6522 +[23:11:37] + 349s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=6818 +[23:11:52] + 364s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=7114 +[23:12:07] + 380s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=7410 +[23:12:23] + 395s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=7707 +[23:12:38] + 410s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8006 +[23:12:53] + 425s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8302 +[23:13:08] + 440s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8598 +[23:13:23] + 456s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=8894 +[23:13:38] + 471s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9190 +[23:13:54] + 486s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9486 +[23:14:09] + 501s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=9782 +[23:14:24] + 516s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10078 +[23:14:39] + 531s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10375 +[23:14:54] + 547s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10674 +[23:15:10] + 562s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=7M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=10970 +[23:15:25] + 577s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=820M/1280M peak=915M kills=0 rs=0 reqs=11266 +[23:15:40] + 592s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=11562 +[23:15:55] + 607s paperless-postgres=68M/256M peak=176M kills=0 rs=0 paperless-redis=6M/128M peak=10M kills=0 rs=0 paperless-webserver=819M/1280M peak=915M kills=0 rs=0 reqs=11858 +[23:15:55] memory watch: killed=False tight=[] requests=11858 codes={'302': 11858} +[23:15:55] MV-paperless-ngx: ABORT — putting the FROM images back +[23:19:06] ABORT: the app did NOT come back (rc=0, 181.2s) \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-full.log b/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-full.log new file mode 100644 index 00000000..7ee464a1 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-full.log @@ -0,0 +1,216 @@ +paperless-webserver | [init-start] paperless-ngx docker container starting... +paperless-webserver | [init-start] paperless-ngx docker container starting init as root +paperless-webserver | [env-init] Checking for environment from files +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Redis version=7.4.12, bits=64, commit=00000000, modified=0, pid=1, just started +paperless-redis | 1:C 03 Nov 2026 00:01:36.665 * Configuration loaded +paperless-redis | 1:M 03 Nov 2026 00:01:36.665 * monotonic clock: POSIX clock_gettime +paperless-redis | 1:M 03 Nov 2026 00:01:36.666 * Running mode=standalone, port=6379. +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Server initialized +paperless-redis | 1:M 03 Nov 2026 00:01:36.667 * Ready to accept connections tcp +paperless-postgres | The files belonging to this database system will be owned by user "postgres". +paperless-postgres | This user must also own the server process. +paperless-postgres | +paperless-postgres | The database cluster will be initialized with locale "en_US.utf8". +paperless-postgres | The default database encoding has accordingly been set to "UTF8". +paperless-postgres | The default text search configuration will be set to "english". +paperless-postgres | +paperless-postgres | Data page checksums are enabled. +paperless-postgres | +paperless-postgres | fixing permissions on existing directory /var/lib/postgresql/18/docker ... ok +paperless-postgres | creating subdirectories ... ok +paperless-postgres | selecting dynamic shared memory implementation ... posix +paperless-postgres | selecting default "max_connections" ... 100 +paperless-postgres | selecting default "shared_buffers" ... 128MB +paperless-postgres | selecting default time zone ... Europe/Budapest +paperless-postgres | creating configuration files ... ok +paperless-postgres | running bootstrap script ... ok +paperless-postgres | sh: locale: not found +paperless-postgres | 2026-11-03 00:01:37.258 CET [39] WARNING: no usable system locales were found +paperless-postgres | performing post-bootstrap initialization ... ok +paperless-postgres | initdb: warning: enabling "trust" authentication for local connections +paperless-postgres | initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb. +paperless-postgres | syncing data to disk ... ok +paperless-postgres | +paperless-webserver | [env-init] No *_FILE environment found +paperless-postgres | +paperless-postgres | Success. You can now start the database server using: +paperless-postgres | +paperless-postgres | pg_ctl -D /var/lib/postgresql/18/docker -l logfile start +paperless-postgres | +paperless-postgres | waiting for server to start....2026-11-03 00:01:38.373 CET [45] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-webserver | [init-redis-wait] Waiting for Redis to report ready +paperless-webserver | [init-tesseract-langs] Checking if additional teseract languages needed +paperless-webserver | [init-db-wait] Waiting for PostgreSQL to start... +paperless-webserver | Installing languages... +paperless-webserver | [init-user] No UID changes for paperless +paperless-webserver | [init-user] No GID changes for paperless +paperless-webserver | [init-folders] Running with root privileges, adjusting directories and permissions +paperless-webserver | mkdir: created directory '/tmp/paperless' +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-eng already installed! +paperless-webserver | changed ownership of '/tmp/paperless' from root:root to paperless:paperless +paperless-webserver | [init-tesseract-langs] Package tesseract-ocr-deu already installed! +paperless-webserver | paperless-postgres:5432 - accepting connections +paperless-webserver | [init-db-wait] Connected to PostgreSQL +paperless-webserver | [init-db-wait] Database is ready +paperless-webserver | [init-compile-bytecode] Compiling bytecode for: /usr/src/paperless/src /usr/local/lib/python3.14/site-packages/django /usr/local/lib/python3.14/site-packages/celery /usr/local/lib/python3.14/site-packages/kombu /usr/local/lib/python3.14/site-packages/rest_framework /usr/local/lib/python3.14/site-packages/django_filters /usr/local/lib/python3.14/site-packages/whitenoise /usr/local/lib/python3.14/site-packages/corsheaders /usr/local/lib/python3.14/site-packages/django_extensions /usr/local/lib/python3.14/site-packages/guardian /usr/local/lib/python3.14/site-packages/allauth /usr/local/lib/python3.14/site-packages/drf_spectacular /usr/local/lib/python3.14/site-packages/drf_spectacular_sidecar /usr/local/lib/python3.14/site-packages/treenode /usr/local/lib/python3.14/site-packages/compression_middleware +paperless-webserver | Waiting for Redis... +paperless-webserver | Connected to Redis broker. +paperless-webserver | [init-redis-wait] Redis ready +paperless-postgres | 2026-11-03 00:01:38.376 CET [45] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-webserver | [init-compile-bytecode] Done in 5s +paperless-webserver | [init-migrations] Apply database migrations... +paperless-webserver | [init-tesseract-langs] Installing package tesseract-ocr-hun... +paperless-webserver | System check identified no issues (0 silenced). +paperless-webserver | [init-tesseract-langs] Installed tesseract-ocr-hun +paperless-webserver | [init-tesseract-langs] Additional packages installed +paperless-webserver | Operations to perform: +paperless-webserver | Apply all migrations: account, admin, auditlog, auth, authtoken, contenttypes, documents, guardian, mfa, paperless, paperless_mail, sessions, socialaccount +paperless-webserver | Running migrations: +paperless-webserver | Applying documents.0003_remove_document_storage_type... OK +paperless-webserver | Applying documents.0004_workflowtrigger_filter_has_any_correspondents_and_more... OK +paperless-webserver | Applying documents.0005_alter_document_checksum_unique... OK +paperless-webserver | Applying documents.0006_document_content_length... OK +paperless-webserver | Applying documents.0007_sharelinkbundle... OK +paperless-webserver | Applying documents.0008_workflowaction_passwords_alter_workflowaction_type... OK +paperless-webserver | Applying documents.0009_alter_document_content_length... OK +paperless-webserver | Applying documents.0010_optimize_integer_field_sizes... OK +paperless-webserver | Applying documents.0011_alter_workflowaction_type... OK +paperless-webserver | Applying documents.0012_document_root_document... OK +paperless-webserver | Applying documents.0013_alter_paperlesstask_task_name... OK +paperless-webserver | Applying documents.0014_savedview_visibility_to_ui_settings... OK +paperless-postgres | 2026-11-03 00:01:38.390 CET [51] LOG: database system was shut down at 2026-11-03 00:01:37 CET +paperless-postgres | 2026-11-03 00:01:38.399 CET [45] LOG: database system is ready to accept connections +paperless-postgres | done +paperless-postgres | server started +paperless-postgres | CREATE DATABASE +paperless-postgres | +paperless-postgres | +paperless-postgres | /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/* +paperless-postgres | +paperless-postgres | waiting for server to shut down....2026-11-03 00:01:38.597 CET [45] LOG: received fast shutdown request +paperless-postgres | 2026-11-03 00:01:38.601 CET [45] LOG: aborting any active transactions +paperless-postgres | 2026-11-03 00:01:38.604 CET [45] LOG: background worker "logical replication launcher" (PID 54) exited with exit code 1 +paperless-postgres | 2026-11-03 00:01:38.604 CET [49] LOG: shutting down +paperless-postgres | 2026-11-03 00:01:38.607 CET [49] LOG: checkpoint starting: shutdown immediate +paperless-postgres | 2026-11-03 00:01:38.749 CET [49] LOG: checkpoint complete: wrote 943 buffers (5.8%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=0.024 s, sync=0.105 s, total=0.145 s; sync files=303, longest=0.073 s, average=0.001 s; distance=4362 kB, estimate=4362 kB; lsn=0/1BA8868, redo lsn=0/1BA8868 +paperless-postgres | 2026-11-03 00:01:38.775 CET [45] LOG: database system is shut down +paperless-postgres | done +paperless-postgres | server stopped +paperless-postgres | +paperless-postgres | PostgreSQL init process complete; ready for start up. +paperless-postgres | +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: starting PostgreSQL 18.6 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv4 address "0.0.0.0", port 5432 +paperless-webserver | Applying documents.0015_document_version_index_and_more... OK +paperless-webserver | Applying documents.0016_sha256_checksums... OK +paperless-webserver | Applying documents.0017_migrate_fulltext_query_field_prefixes... OK +paperless-webserver | Applying documents.0018_saved_view_simple_search_rules... OK +paperless-webserver | Applying documents.0019_task_system_redesign... OK +paperless-webserver | Applying documents.0020_drop_celery_results... OK +paperless-webserver | Applying documents.0021_widen_workflow_integer_fields... OK +paperless-webserver | Applying documents.0022_add_perf_indexes... OK +paperless-webserver | Applying documents.0023_savedview_icon... OK +paperless-webserver | Applying documents.0024_alter_workflowaction_type... OK +paperless-webserver | Applying documents.0025_workflowaction_apply_ai_suggestions... OK +paperless-webserver | Applying documents.0026_alter_document_archive_checksum_and_more... OK +paperless-postgres | 2026-11-03 00:01:38.840 CET [1] LOG: listening on IPv6 address "::", port 5432 +paperless-postgres | 2026-11-03 00:01:38.850 CET [1] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" +paperless-postgres | 2026-11-03 00:01:38.861 CET [67] LOG: database system was shut down at 2026-11-03 00:01:38 CET +paperless-postgres | 2026-11-03 00:01:38.870 CET [1] LOG: database system is ready to accept connections +paperless-webserver | Applying documents.0027_documentbarcode... OK +paperless-webserver | Applying paperless.0005_applicationconfiguration_ai_enabled_and_more... OK +paperless-webserver | Applying paperless.0006_applicationconfiguration_barcode_tag_split... OK +paperless-webserver | Applying paperless.0007_optimize_integer_field_sizes... OK +paperless-webserver | Applying paperless.0008_replace_skip_archive_file... OK +paperless-webserver | Applying paperless.0009_alter_applicationconfiguration_options... OK +paperless-webserver | Applying paperless.0010_alter_applicationconfiguration_llm_embedding_backend... OK +paperless-webserver | Applying paperless.0011_applicationconfiguration_llm_embedding_chunk_size... OK +paperless-webserver | Applying paperless.0012_applicationconfiguration_llm_output_language... OK +paperless-webserver | Applying paperless.0013_applicationconfiguration_llm_request_timeout... OK +paperless-webserver | Applying paperless.0014_applicationconfiguration_remote_ocr_api_key_and_more... OK +paperless-webserver | Applying paperless.0015_applicationconfiguration_remote_ocr_mode... OK +paperless-webserver | Applying paperless.0016_alter_applicationconfiguration_ai_enabled... OK +paperless-webserver | Applying paperless.0017_applicationconfiguration_llm_embedding_api_key... OK +paperless-webserver | Applying paperless.0018_applicationconfiguration_barcode_store_values... OK +paperless-webserver | Applying paperless_mail.0002_optimize_integer_field_sizes... OK +paperless-webserver | Applying paperless_mail.0003_mailrule_stop_processing... OK +paperless-webserver | Applying paperless_mail.0004_processedmail_uid_validity... OK +paperless-webserver | [init-index] Checking search index... +paperless-webserver | [init-llmindex-migrate] Checking for pending LLM index migrations... +paperless-webserver | [init-superuser] Creating superuser... +paperless-webserver | Did not create superuser, a user admin already exists +paperless-webserver | [init-superuser] Superuser creation done +paperless-webserver | [init-checks] Running Django checks +paperless-webserver | System check identified no issues (0 silenced). +paperless-webserver | [custom-init] /custom-cont-init.d doesn't exist, nothing to do +paperless-webserver | [init-complete] paperless-ngx docker container init completed in 30 seconds +paperless-webserver | [init-complete] Starting services +paperless-webserver | [svc-flower] Checking if we should start flower... +paperless-webserver | [svc-flower] Not starting flower +paperless-webserver | [INFO] Starting granian (main PID: 291) +paperless-webserver | [INFO] Listening at: http://:::8000 +paperless-webserver | [INFO] Spawning worker-1 with PID: 312 +paperless-webserver | celery beat v5.6.3 (recovery) is starting. +paperless-webserver | [2026-11-03 00:05:12,167] [INFO] [paperless.management.consumer] Processing existing files in /usr/src/paperless/consume +paperless-webserver | [2026-11-03 00:05:12,167] [INFO] [paperless.management.consumer] Watching /usr/src/paperless/consume using native file system events +paperless-webserver | __ - ... __ - _ +paperless-webserver | LocalTime -> 2026-11-03 00:05:12 +paperless-webserver | Configuration -> +paperless-webserver | . broker -> redis://paperless-redis:6379// +paperless-webserver | . loader -> celery.loaders.app.AppLoader +paperless-webserver | . scheduler -> celery.beat.PersistentScheduler +paperless-webserver | . db -> /usr/src/paperless/data/celerybeat-schedule.db +paperless-webserver | . logfile -> [stderr]@%INFO +paperless-webserver | . maxinterval -> 5.00 minutes (300s) +paperless-webserver | [2026-11-03 00:05:12,819] [INFO] [celery.beat] beat: Starting... +paperless-webserver | [2026-11-03 00:05:12,877] [INFO] [celery.beat] Scheduler: Sending due task Train the classifier (documents.tasks.train_classifier) +paperless-webserver | [2026-11-03 00:05:12,945] [INFO] [celery.beat] Scheduler: Sending due task Check and run scheduled workflows (documents.tasks.check_scheduled_workflows) +paperless-webserver | +paperless-webserver | -------------- celery@93b6f16637c4 v5.6.3 (recovery) +paperless-webserver | --- ***** ----- +paperless-webserver | -- ******* ---- Linux-7.0.14-26-pve-x86_64-with-glibc2.41 2026-11-03 00:05:13 +paperless-webserver | - *** --- * --- +paperless-webserver | - ** ---------- [config] +paperless-webserver | - ** ---------- .> app: paperless:0x78f463510ec0 +paperless-webserver | - ** ---------- .> transport: redis://paperless-redis:6379// +paperless-webserver | - ** ---------- .> results: redis://paperless-redis:6379/ +paperless-webserver | - *** --- * --- .> concurrency: 1 (prefork) +paperless-webserver | -- ******* ---- .> task events: ON +paperless-webserver | --- ***** ----- +paperless-webserver | -------------- [queues] +paperless-webserver | .> celery exchange=celery(direct) key=celery +paperless-webserver | +paperless-webserver | +paperless-webserver | [tasks] +paperless-webserver | . documents.signals.handlers.process_cf_select_update +paperless-webserver | . documents.tasks.apply_ai_suggestions +paperless-webserver | . documents.tasks.build_share_link_bundle +paperless-webserver | . documents.tasks.bulk_update_documents +paperless-webserver | . documents.tasks.check_scheduled_workflows +paperless-webserver | . documents.tasks.cleanup_expired_share_link_bundles +paperless-webserver | . documents.tasks.consume_file +paperless-webserver | . documents.tasks.empty_trash +paperless-webserver | . documents.tasks.index_document +paperless-webserver | . documents.tasks.index_optimize +paperless-webserver | . documents.tasks.llmindex_index +paperless-webserver | . documents.tasks.remove_document_from_index +paperless-webserver | . documents.tasks.remove_document_from_llm_index +paperless-webserver | . documents.tasks.sanity_check +paperless-webserver | . documents.tasks.train_classifier +paperless-webserver | . documents.tasks.update_document_content_maybe_archive_file +paperless-webserver | . documents.tasks.update_document_in_llm_index +paperless-webserver | . documents.workflows.webhooks.send_webhook +paperless-webserver | . paperless_mail.mail.apply_mail_action +paperless-webserver | . paperless_mail.mail.error_callback +paperless-webserver | . paperless_mail.tasks.process_mail_accounts +paperless-webserver | +paperless-webserver | [2026-11-03 00:05:13,140] [INFO] [celery.worker.consumer.connection] Connected to redis://paperless-redis:6379// +paperless-webserver | [2026-11-03 00:05:13,162] [INFO] [celery.apps.worker] celery@93b6f16637c4 ready. +paperless-webserver | [2026-11-03 00:05:13,169] [INFO] [celery.worker.strategy] Task documents.tasks.train_classifier[c9694207-1d00-4f27-b9af-e163a57eea90] received +paperless-webserver | [2026-11-03 00:05:13,172] [INFO] [celery.worker.strategy] Task documents.tasks.check_scheduled_workflows[39f32c72-efa8-4ae1-8c71-b8a9794d6eab] received +paperless-webserver | [2026-11-03 00:05:13,490] [INFO] [paperless.tasks] No automatic matching items, not training +paperless-webserver | [2026-11-03 00:05:13,493] [INFO] [celery.app.trace] Task documents.tasks.train_classifier[c9694207-1d00-4f27-b9af-e163a57eea90] succeeded in 0.06620081898290664s: 'No automatic matching items, not training' +paperless-webserver | [2026-11-03 00:05:14,126] [INFO] [celery.app.trace] Task documents.tasks.check_scheduled_workflows[39f32c72-efa8-4ae1-8c71-b8a9794d6eab] succeeded in 0.07575203501619399s: None +paperless-webserver | [2026-11-03 00:05:14,433] [INFO] [paperless.asgi] [init] Paperless-ngx version: v3.4.1 diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-states.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-states.json new file mode 100644 index 00000000..1b6a5b79 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/to-states.json @@ -0,0 +1,20 @@ +{ + "paperless-postgres": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "paperless-redis": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + }, + "paperless-webserver": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/paperless-ngx/verdict.json b/documentation/audits/security-2026-11-02/bench/paperless-ngx/verdict.json new file mode 100644 index 00000000..d0ef7334 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/paperless-ngx/verdict.json @@ -0,0 +1,97 @@ +{ + "harness_version": 5, + "edge": "MV-paperless-ngx", + "app": "paperless-ngx", + "note": "night 2026-09-23 within-a-major move: paperless-webserver=ghcr.io/paperless-ngx/paperless-ngx:3.4.1", + "from": { + "paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:2.20.15", + "paperless-postgres": "postgres:18-alpine", + "paperless-redis": "redis:7-alpine" + }, + "to": { + "paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:3.4.1", + "paperless-postgres": "postgres:18-alpine", + "paperless-redis": "redis:7-alpine" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Kpaperless-webserver | [init-migrations] Apply database migrations...", + "abort": "refuses", + "abort_detail": "m is ready to accept connections\n\u001b[2Kpaperless-postgres | 2026-11-03 00:06:38.951 CET [65] LOG: checkpoint starting: time\n\u001b[2Kpaperless-postgres | 2026-11-03 00:07:35.808 CET [65] LOG: checkpoint complete: wrote 568 buffers (3.5%), wrote 3 SLRU buffers; 0 WAL file(s) added, 0 removed, 1 recycled; write=56.737 s, sync=0.092 s, total=56.858 s; sync files=983, longest=0.003 s, average=0.001 s; distance=6068 kB, estimate=6068 kB; lsn=0/2195960, redo lsn=0/21958D0\n\u001b[2Kpaperless-postgres | 2026-11-03 00:16:39.005 CET [65] LOG: checkpoint starting: time\n\u001b[2Kpaperless-postgres | 2026-11-03 00:16:41.345 CET [65] LOG: checkpoint complete: wrote 23 buffers (0.1%), wrote 1 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=2.308 s, sync=0.015 s, total=2.341 s; sync files=22, longest=0.012 s, average=0.001 s; distance=46 kB, estimate=5465 kB; lsn=0/21A1430, redo lsn=0/21A13D8", + "engine_state_after": { + "paperless-postgres": { + "image": "postgres:18-alpine", + "probe": "datadir major version", + "answer": "18", + "probe_rc": 0 + } + }, + "memory": { + "soak_s": 607.6, + "requested_s": 600, + "requests": 11858, + "codes": { + "302": 11858 + }, + "first_kill": null, + "containers": { + "paperless-postgres": { + "limit": 268435456, + "peak": 184569856, + "peak_pct": 0.688, + "anon_peak_sampled": 8581120, + "anon_peak_pct": 0.032, + "anon_live_peak_sampled": 8581120, + "anon_live_peak_pct": 0.032, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "paperless-redis": { + "limit": 134217728, + "peak": 10706944, + "peak_pct": 0.08, + "anon_peak_sampled": 3092480, + "anon_peak_pct": 0.023, + "anon_live_peak_sampled": 3092480, + "anon_live_peak_pct": 0.023, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + }, + "paperless-webserver": { + "limit": 1342177280, + "peak": 959496192, + "peak_pct": 0.715, + "anon_peak_sampled": 544321536, + "anon_peak_pct": 0.406, + "anon_live_peak_sampled": 544301056, + "anon_live_peak_pct": 0.406, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 62.4, + "measured_at": "2026-11-02T23:19:06Z", + "evidence": "evidence/MV-paperless-ngx", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 1104.6 +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/MV-termix.log b/documentation/audits/security-2026-11-02/bench/termix/MV-termix.log new file mode 100644 index 00000000..9eb5aaa3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/MV-termix.log @@ -0,0 +1,116 @@ +[22:48:28] scratch drive folders cleared before FROM (R-656): none existed +[22:48:28] MV-termix: deploying termix at FROM {'termix': 'ghcr.io/lukegus/termix:26.10.5'} +[22:48:59] FROM settled=True in 30.9s :: {"termix": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:48:59] fixture: the BOX walk's own (Termix), through upgrade_boxport +[22:48:59] termix: seeded user drill724e084b via /users/create +[22:49:00] termix: readback found=True (http 200, control refused as it must) +[22:49:00] C1 (seed reads back BEFORE): True +[22:49:00] MV-termix: swapping to TO {'termix': 'ghcr.io/lukegus/termix:26.11.0'} +[22:49:29] TO up -d rc=0 +[22:49:59] TO settled=True in 30.9s :: {"termix": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:50:00] migration lines observed: 6 +[22:50:00] termix: readback found=True (http 200, control refused as it must) +[22:50:00] RESULT (seed reads back AFTER): True +[22:50:00] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8080 +[22:50:16] + 15s termix=250M/256M peak=256M kills=0 rs=0 reqs=304 +[22:50:31] + 30s termix=250M/256M peak=256M kills=0 rs=0 reqs=604 +[22:50:46] + 45s termix=249M/256M peak=256M kills=0 rs=0 reqs=904 +[22:51:01] + 60s termix=249M/256M peak=256M kills=0 rs=0 reqs=1204 +[22:51:16] + 76s termix=248M/256M peak=256M kills=0 rs=0 reqs=1504 +[22:51:31] + 91s termix=249M/256M peak=256M kills=0 rs=0 reqs=1805 +[22:51:46] + 106s termix=242M/256M peak=256M kills=0 rs=0 reqs=2105 +[22:52:01] + 121s termix=241M/256M peak=256M kills=0 rs=0 reqs=2405 +[22:52:17] + 136s termix=242M/256M peak=256M kills=0 rs=0 reqs=2705 +[22:52:32] + 151s termix=241M/256M peak=256M kills=0 rs=0 reqs=3005 +[22:52:47] + 166s termix=242M/256M peak=256M kills=0 rs=0 reqs=3305 +[22:53:02] + 182s termix=242M/256M peak=256M kills=0 rs=0 reqs=3605 +[22:53:17] + 197s termix=242M/256M peak=256M kills=0 rs=0 reqs=3909 +[22:53:32] + 212s termix=240M/256M peak=256M kills=0 rs=0 reqs=4209 +[22:53:47] + 227s termix=241M/256M peak=256M kills=0 rs=0 reqs=4509 +[22:54:02] + 242s termix=241M/256M peak=256M kills=0 rs=0 reqs=4809 +[22:54:18] + 257s termix=240M/256M peak=256M kills=0 rs=0 reqs=5109 +[22:54:33] + 272s termix=240M/256M peak=256M kills=0 rs=0 reqs=5410 +[22:54:48] + 287s termix=241M/256M peak=256M kills=0 rs=0 reqs=5711 +[22:55:03] + 302s termix=238M/256M peak=256M kills=0 rs=0 reqs=6013 +[22:55:18] + 318s termix=232M/256M peak=256M kills=0 rs=0 reqs=6313 +[22:55:33] + 333s termix=226M/256M peak=256M kills=0 rs=0 reqs=6614 +[22:55:48] + 348s termix=225M/256M peak=256M kills=0 rs=0 reqs=6917 +[22:56:04] + 363s termix=223M/256M peak=256M kills=0 rs=0 reqs=7219 +[22:56:19] + 378s termix=218M/256M peak=256M kills=0 rs=0 reqs=7519 +[22:56:34] + 393s termix=217M/256M peak=256M kills=0 rs=0 reqs=7819 +[22:56:49] + 409s termix=214M/256M peak=256M kills=0 rs=0 reqs=8119 +[22:57:04] + 424s termix=213M/256M peak=256M kills=0 rs=0 reqs=8421 +[22:57:19] + 439s termix=210M/256M peak=256M kills=0 rs=0 reqs=8721 +[22:57:34] + 454s termix=203M/256M peak=256M kills=0 rs=0 reqs=9021 +[22:57:50] + 469s termix=202M/256M peak=256M kills=0 rs=0 reqs=9323 +[22:58:05] + 484s termix=191M/256M peak=256M kills=0 rs=0 reqs=9623 +[22:58:20] + 499s termix=189M/256M peak=256M kills=0 rs=0 reqs=9925 +[22:58:35] + 514s termix=179M/256M peak=256M kills=0 rs=0 reqs=10225 +[22:58:50] + 530s termix=178M/256M peak=256M kills=0 rs=0 reqs=10525 +[22:59:05] + 545s termix=178M/256M peak=256M kills=0 rs=0 reqs=10825 +[22:59:20] + 560s termix=178M/256M peak=256M kills=0 rs=0 reqs=11127 +[22:59:35] + 575s termix=178M/256M peak=256M kills=0 rs=0 reqs=11427 +[22:59:51] + 590s termix=178M/256M peak=256M kills=0 rs=0 reqs=11727 +[23:00:06] + 605s termix=178M/256M peak=256M kills=0 rs=0 reqs=12029 +[23:00:06] memory watch: killed=False tight=[] requests=12029 codes={'200': 12029} +[23:00:06] MV-termix: ABORT — putting the FROM images back +[23:00:38] termix: readback found=True (http 200, control refused as it must) +[23:00:38] ABORT: app came back in 30.9s; data present=True +{ + "harness_version": 5, + "edge": "MV-termix", + "app": "termix", + "note": "night 2026-09-23 within-a-major move: termix=ghcr.io/lukegus/termix:26.11.0", + "from": { + "termix": "ghcr.io/lukegus/termix:26.10.5" + }, + "to": { + "termix": "ghcr.io/lukegus/termix:26.11.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Ktermix | [11:49:42 PM] [INFO] [\ud83d\uddc4\ufe0f] Database layer pre-upgrade backup created [op:database_layer_preupgrade_backup_created]", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": null, + "memory": { + "soak_s": 605.6, + "requested_s": 600, + "requests": 12029, + "codes": { + "200": 12029 + }, + "first_kill": null, + "containers": { + "termix": { + "limit": 268435456, + "peak": 268435456, + "peak_pct": 1.0, + "anon_peak_sampled": 100642816, + "anon_peak_pct": 0.375, + "anon_live_peak_sampled": 100642816, + "anon_live_peak_pct": 0.375, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-11-02T23:00:38Z", + "evidence": "evidence/MV-termix", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 730.2 +} diff --git a/documentation/audits/security-2026-11-02/bench/termix/abort-states.json b/documentation/audits/security-2026-11-02/bench/termix/abort-states.json new file mode 100644 index 00000000..6a39e4b3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/abort-states.json @@ -0,0 +1,8 @@ +{ + "termix": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/compose-final.log b/documentation/audits/security-2026-11-02/bench/termix/compose-final.log new file mode 100644 index 00000000..d75100ef --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/compose-final.log @@ -0,0 +1,95 @@ +termix | Setting up user permissions (PUID: 1000, PGID: 1000)... +termix | usermod: no changes +termix | User node is now UID: 1000, GID: 1000 +termix | Loading persisted SSL settings from /app/data/.env +termix | Configuring web UI to run on port: 8080 +termix | SSL disabled - using HTTP-only configuration (default) +termix | Data directory is writable +termix | Starting nginx... +termix | Starting backend services... +termix | [12:00:21 AM] [INFO] [🚀] Termix backend initialization started [op:backend_init_start] +termix | [12:00:21 AM] [INFO] [📦] Termix Backend starting - Version: 26.10.5 [op:startup] +termix | [12:00:22 AM] [INFO] [🚀] SSL not enabled - skipping certificate generation [op:ssl_disabled_default] +termix | [12:00:22 AM] [SUCCESS] [🚀] SSL setup completed [op:backend_init_ssl] +termix | [12:00:22 AM] [INFO] [🗄️] Initializing SQLite database [op:db_init] +termix | [12:00:22 AM] [INFO] [🗄️] Performance indexes ready in 0ms [op:performance_index_create] +termix | [12:00:22 AM] [SUCCESS] [🗄️] Schema migration completed [op:schema_migration] +termix | [12:00:22 AM] [SUCCESS] [🚀] Database initialized (sqlite) [op:backend_init_db] +termix | [12:00:22 AM] [INFO] [🗄️] User key migration pass finished [op:dek_migration_boot] +termix | [12:00:22 AM] [INFO] [🗄️] Removed routine plugin audit entries [op:audit_noise_cleanup] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin alerts@1.1.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin classic-layout@1.0.2 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin classic-themes@1.0.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin credential-tools@1.0.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin docker@1.2.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin file-manager@1.1.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin host-metrics@1.2.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin host-status@1.0.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin import-export@1.0.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin remote-desktop@1.2.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin serial@1.0.2 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin snippets@1.1.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin ssh-terminal@1.1.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin sso@1.0.4 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin sync@1.0.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin telemetry@1.0.2 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin totp@1.0.2 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin tunnels@1.2.1 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin webauthn@1.1.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Loaded plugin workspaces@1.1.0 [op:plugin_load] +termix | [12:00:23 AM] [INFO] [🧩] Revoked snippets capability "secrets:own": the manifest no longer declares it [op:plugin_grants] +termix | [12:00:23 AM] [INFO] [🧩] Revoked ssh-terminal capability "notify:send": the manifest no longer declares it [op:plugin_grants] +termix | [12:00:23 AM] [INFO] [🧩] Revoked ssh-terminal capability "ssh:transport": the manifest no longer declares it [op:plugin_grants] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/alerts [op:plugin_http_mount] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin alerts [op:plugin_activate] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/classic-layout [op:plugin_http_mount] +termix | [12:00:23 AM] [INFO] [🧩] Classic layout ready [op:plugin:classic-layout] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin classic-layout [op:plugin_activate] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin classic-themes [op:plugin_activate] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/docker [op:plugin_http_mount] +termix | [12:00:23 AM] [WARN] [🧩] Plugin docker serves /plugin-ws/docker/console without core authentication [op:plugin_ws_public] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-ws/docker/console [op:plugin_ws_mount] +termix | [12:00:23 AM] [INFO] [🧩] Docker mounted at /plugin-api/docker and /plugin-ws/docker/console [op:plugin:docker] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin docker [op:plugin_activate] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-ws/file-manager/local-events [op:plugin_ws_mount] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/file-manager [op:plugin_http_mount] +termix | [12:00:23 AM] [INFO] [🧩] File manager mounted at /plugin-api/file-manager [op:plugin:file-manager] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin file-manager [op:plugin_activate] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/host-metrics [op:plugin_http_mount] +termix | [12:00:23 AM] [INFO] [🧩] Host Metrics mounted at /plugin-api/host-metrics [op:plugin:host-metrics] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin host-metrics [op:plugin_activate] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-api/tunnels [op:plugin_http_mount] +termix | [12:00:23 AM] [INFO] [🧩] Mounted /plugin-ws/tunnels/c2s/stream [op:plugin_ws_mount] +termix | [12:00:23 AM] [INFO] [🧩] Tunnel routes mounted at /plugin-api/tunnels [op:plugin:tunnels] +termix | [12:00:23 AM] [SUCCESS] [🧩] Activated plugin tunnels [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Plugin remote-desktop optional service "recordings.writer" is not available [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/remote-desktop [op:plugin_http_mount] +termix | [12:00:24 AM] [WARN] [🧩] Plugin remote-desktop serves /plugin-ws/remote-desktop/display without core authentication [op:plugin_ws_public] +termix | [12:00:24 AM] [INFO] [🧩] Mounted raw upgrade /plugin-ws/remote-desktop/display [op:plugin_ws_mount] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin remote-desktop [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/snippets [op:plugin_http_mount] +termix | [12:00:24 AM] [INFO] [🧩] Snippets routes mounted at /plugin-api/snippets [op:plugin:snippets] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin snippets [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Plugin ssh-terminal optional service "tmux.sessions" is not available [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Plugin ssh-terminal optional service "sessions.sharing" is not available [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Plugin ssh-terminal optional service "recordings.writer" is not available [op:plugin_activate] +termix | [12:00:24 AM] [WARN] [🧩] Plugin ssh-terminal serves /plugin-ws/ssh-terminal/terminal without core authentication [op:plugin_ws_public] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-ws/ssh-terminal/terminal [op:plugin_ws_mount] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-ws/ssh-terminal/local-terminal [op:plugin_ws_mount] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/ssh-terminal [op:plugin_http_mount] +termix | [12:00:24 AM] [INFO] [🧩] SSH terminal mounted at /plugin-ws/ssh-terminal/terminal [op:plugin:ssh-terminal] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin ssh-terminal [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/totp [op:plugin_http_mount] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin totp [op:plugin_activate] +termix | [12:00:24 AM] [WARN] [🧩] Plugin webauthn serves 1 route(s) without authentication: /authenticate/options [op:plugin_http_public] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/webauthn [op:plugin_http_mount] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin webauthn [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🧩] Mounted /plugin-api/workspaces [op:plugin_http_mount] +termix | [12:00:24 AM] [INFO] [🧩] Workspaces routes mounted at /plugin-api/workspaces [op:plugin:workspaces] +termix | [12:00:24 AM] [SUCCESS] [🧩] Activated plugin workspaces [op:plugin_activate] +termix | [12:00:24 AM] [INFO] [🚀] Loaded 20 plugin(s) [op:plugin_init] +termix | [12:00:24 AM] [SUCCESS] [🚀] Termix backend started successfully [op:backend_init_complete,duration:3291ms] +termix | [12:00:38 AM] [INFO] [🔐] User login request received [op:user_login_request] +termix | [12:00:38 AM] [SUCCESS] [🔐] User login successful [op:user_login_complete,user:KmgyNFfXz9Knv7zojcKnI] +termix | [12:00:38 AM] [INFO] [🔐] User login request received [op:user_login_request] +termix | [12:00:38 AM] [WARN] [🔐] Login failed: user not found [op:user_login] diff --git a/documentation/audits/security-2026-11-02/bench/termix/engine-state.json b/documentation/audits/security-2026-11-02/bench/termix/engine-state.json new file mode 100644 index 00000000..ec747fa4 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/engine-state.json @@ -0,0 +1 @@ +null \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/files-after-detail.json b/documentation/audits/security-2026-11-02/bench/termix/files-after-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/files-after-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/files-after.json b/documentation/audits/security-2026-11-02/bench/termix/files-after.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/files-after.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/files-before-detail.json b/documentation/audits/security-2026-11-02/bench/termix/files-before-detail.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/files-before-detail.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/files-before.json b/documentation/audits/security-2026-11-02/bench/termix/files-before.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/files-before.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/memory-samples.json b/documentation/audits/security-2026-11-02/bench/termix/memory-samples.json new file mode 100644 index 00000000..a8497b23 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/memory-samples.json @@ -0,0 +1,802 @@ +[ + { + "t": 15.1, + "containers": { + "termix": { + "limit": 268435456, + "current": 262918144, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 304 + }, + { + "t": 30.3, + "containers": { + "termix": { + "limit": 268435456, + "current": 262991872, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 604 + }, + { + "t": 45.4, + "containers": { + "termix": { + "limit": 268435456, + "current": 261353472, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 904 + }, + { + "t": 60.5, + "containers": { + "termix": { + "limit": 268435456, + "current": 261865472, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1204 + }, + { + "t": 75.6, + "containers": { + "termix": { + "limit": 268435456, + "current": 260853760, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1504 + }, + { + "t": 90.8, + "containers": { + "termix": { + "limit": 268435456, + "current": 261099520, + "peak": 268435456, + "anon": 100642816, + "anon_live": 100642816, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 1805 + }, + { + "t": 105.9, + "containers": { + "termix": { + "limit": 268435456, + "current": 253988864, + "peak": 268435456, + "anon": 93745152, + "anon_live": 93745152, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2105 + }, + { + "t": 121.0, + "containers": { + "termix": { + "limit": 268435456, + "current": 253607936, + "peak": 268435456, + "anon": 93761536, + "anon_live": 93761536, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2405 + }, + { + "t": 136.1, + "containers": { + "termix": { + "limit": 268435456, + "current": 253935616, + "peak": 268435456, + "anon": 93765632, + "anon_live": 93765632, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 2705 + }, + { + "t": 151.3, + "containers": { + "termix": { + "limit": 268435456, + "current": 253702144, + "peak": 268435456, + "anon": 93769728, + "anon_live": 93769728, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3005 + }, + { + "t": 166.4, + "containers": { + "termix": { + "limit": 268435456, + "current": 253820928, + "peak": 268435456, + "anon": 93769728, + "anon_live": 93769728, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3305 + }, + { + "t": 181.5, + "containers": { + "termix": { + "limit": 268435456, + "current": 254570496, + "peak": 268435456, + "anon": 93769728, + "anon_live": 93769728, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3605 + }, + { + "t": 196.6, + "containers": { + "termix": { + "limit": 268435456, + "current": 254660608, + "peak": 268435456, + "anon": 93773824, + "anon_live": 93773824, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 3909 + }, + { + "t": 211.8, + "containers": { + "termix": { + "limit": 268435456, + "current": 252698624, + "peak": 268435456, + "anon": 92090368, + "anon_live": 92090368, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4209 + }, + { + "t": 226.9, + "containers": { + "termix": { + "limit": 268435456, + "current": 253046784, + "peak": 268435456, + "anon": 92098560, + "anon_live": 92098560, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4509 + }, + { + "t": 242.0, + "containers": { + "termix": { + "limit": 268435456, + "current": 253075456, + "peak": 268435456, + "anon": 92102656, + "anon_live": 92102656, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 4809 + }, + { + "t": 257.1, + "containers": { + "termix": { + "limit": 268435456, + "current": 252391424, + "peak": 268435456, + "anon": 92106752, + "anon_live": 92106752, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5109 + }, + { + "t": 272.3, + "containers": { + "termix": { + "limit": 268435456, + "current": 252661760, + "peak": 268435456, + "anon": 92106752, + "anon_live": 92106752, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5410 + }, + { + "t": 287.4, + "containers": { + "termix": { + "limit": 268435456, + "current": 253100032, + "peak": 268435456, + "anon": 92143616, + "anon_live": 92143616, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 5711 + }, + { + "t": 302.5, + "containers": { + "termix": { + "limit": 268435456, + "current": 250146816, + "peak": 268435456, + "anon": 92180480, + "anon_live": 92180480, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6013 + }, + { + "t": 317.7, + "containers": { + "termix": { + "limit": 268435456, + "current": 243998720, + "peak": 268435456, + "anon": 92323840, + "anon_live": 92323840, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6313 + }, + { + "t": 332.8, + "containers": { + "termix": { + "limit": 268435456, + "current": 237764608, + "peak": 268435456, + "anon": 92368896, + "anon_live": 92368896, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6614 + }, + { + "t": 348.0, + "containers": { + "termix": { + "limit": 268435456, + "current": 236945408, + "peak": 268435456, + "anon": 92594176, + "anon_live": 92594176, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 6917 + }, + { + "t": 363.2, + "containers": { + "termix": { + "limit": 268435456, + "current": 233848832, + "peak": 268435456, + "anon": 92631040, + "anon_live": 92631040, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7219 + }, + { + "t": 378.3, + "containers": { + "termix": { + "limit": 268435456, + "current": 228593664, + "peak": 268435456, + "anon": 92766208, + "anon_live": 92766208, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7519 + }, + { + "t": 393.4, + "containers": { + "termix": { + "limit": 268435456, + "current": 228130816, + "peak": 268435456, + "anon": 92807168, + "anon_live": 92807168, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 7819 + }, + { + "t": 408.6, + "containers": { + "termix": { + "limit": 268435456, + "current": 224546816, + "peak": 268435456, + "anon": 92979200, + "anon_live": 92979200, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8119 + }, + { + "t": 423.7, + "containers": { + "termix": { + "limit": 268435456, + "current": 223531008, + "peak": 268435456, + "anon": 92979200, + "anon_live": 92979200, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8421 + }, + { + "t": 438.8, + "containers": { + "termix": { + "limit": 268435456, + "current": 220254208, + "peak": 268435456, + "anon": 92991488, + "anon_live": 92991488, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 8721 + }, + { + "t": 453.9, + "containers": { + "termix": { + "limit": 268435456, + "current": 213413888, + "peak": 268435456, + "anon": 92991488, + "anon_live": 92991488, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9021 + }, + { + "t": 469.1, + "containers": { + "termix": { + "limit": 268435456, + "current": 211820544, + "peak": 268435456, + "anon": 92999680, + "anon_live": 92999680, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9323 + }, + { + "t": 484.2, + "containers": { + "termix": { + "limit": 268435456, + "current": 201027584, + "peak": 268435456, + "anon": 92999680, + "anon_live": 92999680, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9623 + }, + { + "t": 499.4, + "containers": { + "termix": { + "limit": 268435456, + "current": 198934528, + "peak": 268435456, + "anon": 93003776, + "anon_live": 93003776, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 9925 + }, + { + "t": 514.5, + "containers": { + "termix": { + "limit": 268435456, + "current": 188309504, + "peak": 268435456, + "anon": 93003776, + "anon_live": 93003776, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10225 + }, + { + "t": 529.6, + "containers": { + "termix": { + "limit": 268435456, + "current": 187539456, + "peak": 268435456, + "anon": 93057024, + "anon_live": 93057024, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10525 + }, + { + "t": 544.7, + "containers": { + "termix": { + "limit": 268435456, + "current": 186851328, + "peak": 268435456, + "anon": 93057024, + "anon_live": 93057024, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 10825 + }, + { + "t": 559.9, + "containers": { + "termix": { + "limit": 268435456, + "current": 187166720, + "peak": 268435456, + "anon": 93057024, + "anon_live": 93057024, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11127 + }, + { + "t": 575.0, + "containers": { + "termix": { + "limit": 268435456, + "current": 187482112, + "peak": 268435456, + "anon": 93057024, + "anon_live": 93057024, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11427 + }, + { + "t": 590.1, + "containers": { + "termix": { + "limit": 268435456, + "current": 187019264, + "peak": 268435456, + "anon": 93065216, + "anon_live": 93065216, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 11727 + }, + { + "t": 605.3, + "containers": { + "termix": { + "limit": 268435456, + "current": 187363328, + "peak": 268435456, + "anon": 93065216, + "anon_live": 93065216, + "swap": 0, + "swap_peak": 0, + "oom_kill": 0, + "restarts": 0, + "oomkilled_flag": false, + "status": "running", + "cgroup": true + } + }, + "requests": 12029 + } +] \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/migration-lines.txt b/documentation/audits/security-2026-11-02/bench/termix/migration-lines.txt new file mode 100644 index 00000000..3908a23b --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/migration-lines.txt @@ -0,0 +1,6 @@ +termix | [11:49:42 PM] [INFO] [🗄️] Database layer pre-upgrade backup created [op:database_layer_preupgrade_backup_created] +termix | [11:49:42 PM] [SUCCESS] [🗄️] Schema migration completed [op:schema_migration] +termix | [11:49:42 PM] [INFO] [🗄️] User key migration pass finished [op:dek_migration_boot] +termix | [11:49:43 PM] [INFO] [🧩] Applied 1 migration(s) for plugin host-metrics: 0003_layout_templates [op:plugin_migrate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted raw upgrade /plugin-ws/remote-desktop/display [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Applied 1 migration(s) for plugin snippets: 0003_secrets [op:plugin_migrate] \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/run.log b/documentation/audits/security-2026-11-02/bench/termix/run.log new file mode 100644 index 00000000..6c7c1b79 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/run.log @@ -0,0 +1,58 @@ +[22:48:28] scratch drive folders cleared before FROM (R-656): none existed +[22:48:28] MV-termix: deploying termix at FROM {'termix': 'ghcr.io/lukegus/termix:26.10.5'} +[22:48:59] FROM settled=True in 30.9s :: {"termix": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:48:59] fixture: the BOX walk's own (Termix), through upgrade_boxport +[22:48:59] termix: seeded user drill724e084b via /users/create +[22:49:00] termix: readback found=True (http 200, control refused as it must) +[22:49:00] C1 (seed reads back BEFORE): True +[22:49:00] MV-termix: swapping to TO {'termix': 'ghcr.io/lukegus/termix:26.11.0'} +[22:49:29] TO up -d rc=0 +[22:49:59] TO settled=True in 30.9s :: {"termix": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}} +[22:50:00] migration lines observed: 6 +[22:50:00] termix: readback found=True (http 200, control refused as it must) +[22:50:00] RESULT (seed reads back AFTER): True +[22:50:00] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:8080 +[22:50:16] + 15s termix=250M/256M peak=256M kills=0 rs=0 reqs=304 +[22:50:31] + 30s termix=250M/256M peak=256M kills=0 rs=0 reqs=604 +[22:50:46] + 45s termix=249M/256M peak=256M kills=0 rs=0 reqs=904 +[22:51:01] + 60s termix=249M/256M peak=256M kills=0 rs=0 reqs=1204 +[22:51:16] + 76s termix=248M/256M peak=256M kills=0 rs=0 reqs=1504 +[22:51:31] + 91s termix=249M/256M peak=256M kills=0 rs=0 reqs=1805 +[22:51:46] + 106s termix=242M/256M peak=256M kills=0 rs=0 reqs=2105 +[22:52:01] + 121s termix=241M/256M peak=256M kills=0 rs=0 reqs=2405 +[22:52:17] + 136s termix=242M/256M peak=256M kills=0 rs=0 reqs=2705 +[22:52:32] + 151s termix=241M/256M peak=256M kills=0 rs=0 reqs=3005 +[22:52:47] + 166s termix=242M/256M peak=256M kills=0 rs=0 reqs=3305 +[22:53:02] + 182s termix=242M/256M peak=256M kills=0 rs=0 reqs=3605 +[22:53:17] + 197s termix=242M/256M peak=256M kills=0 rs=0 reqs=3909 +[22:53:32] + 212s termix=240M/256M peak=256M kills=0 rs=0 reqs=4209 +[22:53:47] + 227s termix=241M/256M peak=256M kills=0 rs=0 reqs=4509 +[22:54:02] + 242s termix=241M/256M peak=256M kills=0 rs=0 reqs=4809 +[22:54:18] + 257s termix=240M/256M peak=256M kills=0 rs=0 reqs=5109 +[22:54:33] + 272s termix=240M/256M peak=256M kills=0 rs=0 reqs=5410 +[22:54:48] + 287s termix=241M/256M peak=256M kills=0 rs=0 reqs=5711 +[22:55:03] + 302s termix=238M/256M peak=256M kills=0 rs=0 reqs=6013 +[22:55:18] + 318s termix=232M/256M peak=256M kills=0 rs=0 reqs=6313 +[22:55:33] + 333s termix=226M/256M peak=256M kills=0 rs=0 reqs=6614 +[22:55:48] + 348s termix=225M/256M peak=256M kills=0 rs=0 reqs=6917 +[22:56:04] + 363s termix=223M/256M peak=256M kills=0 rs=0 reqs=7219 +[22:56:19] + 378s termix=218M/256M peak=256M kills=0 rs=0 reqs=7519 +[22:56:34] + 393s termix=217M/256M peak=256M kills=0 rs=0 reqs=7819 +[22:56:49] + 409s termix=214M/256M peak=256M kills=0 rs=0 reqs=8119 +[22:57:04] + 424s termix=213M/256M peak=256M kills=0 rs=0 reqs=8421 +[22:57:19] + 439s termix=210M/256M peak=256M kills=0 rs=0 reqs=8721 +[22:57:34] + 454s termix=203M/256M peak=256M kills=0 rs=0 reqs=9021 +[22:57:50] + 469s termix=202M/256M peak=256M kills=0 rs=0 reqs=9323 +[22:58:05] + 484s termix=191M/256M peak=256M kills=0 rs=0 reqs=9623 +[22:58:20] + 499s termix=189M/256M peak=256M kills=0 rs=0 reqs=9925 +[22:58:35] + 514s termix=179M/256M peak=256M kills=0 rs=0 reqs=10225 +[22:58:50] + 530s termix=178M/256M peak=256M kills=0 rs=0 reqs=10525 +[22:59:05] + 545s termix=178M/256M peak=256M kills=0 rs=0 reqs=10825 +[22:59:20] + 560s termix=178M/256M peak=256M kills=0 rs=0 reqs=11127 +[22:59:35] + 575s termix=178M/256M peak=256M kills=0 rs=0 reqs=11427 +[22:59:51] + 590s termix=178M/256M peak=256M kills=0 rs=0 reqs=11727 +[23:00:06] + 605s termix=178M/256M peak=256M kills=0 rs=0 reqs=12029 +[23:00:06] memory watch: killed=False tight=[] requests=12029 codes={'200': 12029} +[23:00:06] MV-termix: ABORT — putting the FROM images back +[23:00:38] termix: readback found=True (http 200, control refused as it must) +[23:00:38] ABORT: app came back in 30.9s; data present=True \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/to-full.log b/documentation/audits/security-2026-11-02/bench/termix/to-full.log new file mode 100644 index 00000000..58d236fd --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/to-full.log @@ -0,0 +1,91 @@ +termix | Setting up user permissions (PUID: 1000, PGID: 1000)... +termix | usermod: no changes +termix | User node is now UID: 1000, GID: 1000 +termix | Loading persisted SSL settings from /app/data/.env +termix | Configuring web UI to run on port: 8080 +termix | SSL disabled - using HTTP-only configuration (default) +termix | Data directory is writable +termix | Starting nginx... +termix | Starting backend services... +termix | [11:49:41 PM] [INFO] [🚀] Termix backend initialization started [op:backend_init_start] +termix | [11:49:41 PM] [INFO] [📦] Termix Backend starting - Version: 26.11.0 [op:startup] +termix | [11:49:42 PM] [INFO] [🗄️] Database layer pre-upgrade backup created [op:database_layer_preupgrade_backup_created] +termix | [11:49:42 PM] [INFO] [🚀] SSL not enabled - skipping certificate generation [op:ssl_disabled_default] +termix | [11:49:42 PM] [SUCCESS] [🚀] SSL setup completed [op:backend_init_ssl] +termix | [11:49:42 PM] [INFO] [🗄️] Initializing SQLite database [op:db_init] +termix | [11:49:42 PM] [INFO] [🗄️] Performance indexes ready in 0ms [op:performance_index_create] +termix | [11:49:42 PM] [SUCCESS] [🗄️] Schema migration completed [op:schema_migration] +termix | [11:49:42 PM] [SUCCESS] [🚀] Database initialized (sqlite) [op:backend_init_db] +termix | [11:49:42 PM] [INFO] [🗄️] User key migration pass finished [op:dek_migration_boot] +termix | [11:49:42 PM] [INFO] [🗄️] Removed routine plugin audit entries [op:audit_noise_cleanup] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin alerts@1.2.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin classic-layout@1.1.1 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin classic-themes@1.0.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin credential-tools@1.0.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin docker@1.2.3 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin file-manager@1.1.3 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin host-metrics@1.3.1 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin host-status@1.0.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin import-export@1.0.1 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin remote-desktop@1.3.1 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin serial@1.0.2 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin snippets@1.2.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin ssh-terminal@1.3.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin sso@1.0.5 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin sync@1.1.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin telemetry@1.0.2 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin totp@1.0.2 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin tunnels@1.2.2 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin webauthn@1.2.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Loaded plugin workspaces@1.1.0 [op:plugin_load] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/alerts [op:plugin_http_mount] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin alerts [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/classic-layout [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] Classic layout ready [op:plugin:classic-layout] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin classic-layout [op:plugin_activate] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin classic-themes [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/docker [op:plugin_http_mount] +termix | [11:49:43 PM] [WARN] [🧩] Plugin docker serves /plugin-ws/docker/console without core authentication [op:plugin_ws_public] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-ws/docker/console [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Docker mounted at /plugin-api/docker and /plugin-ws/docker/console [op:plugin:docker] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin docker [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-ws/file-manager/local-events [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/file-manager [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] File manager mounted at /plugin-api/file-manager [op:plugin:file-manager] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin file-manager [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Applied 1 migration(s) for plugin host-metrics: 0003_layout_templates [op:plugin_migrate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/host-metrics [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] Host Metrics mounted at /plugin-api/host-metrics [op:plugin:host-metrics] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin host-metrics [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/tunnels [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-ws/tunnels/c2s/stream [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Tunnel routes mounted at /plugin-api/tunnels [op:plugin:tunnels] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin tunnels [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Plugin remote-desktop optional service "recordings.writer" is not available [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/remote-desktop [op:plugin_http_mount] +termix | [11:49:43 PM] [WARN] [🧩] Plugin remote-desktop serves /plugin-ws/remote-desktop/display without core authentication [op:plugin_ws_public] +termix | [11:49:43 PM] [INFO] [🧩] Mounted raw upgrade /plugin-ws/remote-desktop/display [op:plugin_ws_mount] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin remote-desktop [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Applied 1 migration(s) for plugin snippets: 0003_secrets [op:plugin_migrate] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/snippets [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] Snippets routes mounted at /plugin-api/snippets [op:plugin:snippets] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin snippets [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Plugin ssh-terminal optional service "tmux.sessions" is not available [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Plugin ssh-terminal optional service "sessions.sharing" is not available [op:plugin_activate] +termix | [11:49:43 PM] [INFO] [🧩] Plugin ssh-terminal optional service "recordings.writer" is not available [op:plugin_activate] +termix | [11:49:43 PM] [WARN] [🧩] Plugin ssh-terminal serves /plugin-ws/ssh-terminal/terminal without core authentication [op:plugin_ws_public] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-ws/ssh-terminal/terminal [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-ws/ssh-terminal/local-terminal [op:plugin_ws_mount] +termix | [11:49:43 PM] [INFO] [🧩] Mounted /plugin-api/ssh-terminal [op:plugin_http_mount] +termix | [11:49:43 PM] [INFO] [🧩] SSH terminal mounted at /plugin-ws/ssh-terminal/terminal [op:plugin:ssh-terminal] +termix | [11:49:43 PM] [SUCCESS] [🧩] Activated plugin ssh-terminal [op:plugin_activate] +termix | [11:49:44 PM] [INFO] [🧩] Mounted /plugin-api/totp [op:plugin_http_mount] +termix | [11:49:44 PM] [SUCCESS] [🧩] Activated plugin totp [op:plugin_activate] +termix | [11:49:44 PM] [WARN] [🧩] Plugin webauthn serves 2 route(s) without authentication: /authenticate/options, /login-options [op:plugin_http_public] +termix | [11:49:44 PM] [INFO] [🧩] Mounted /plugin-api/webauthn [op:plugin_http_mount] +termix | [11:49:44 PM] [SUCCESS] [🧩] Activated plugin webauthn [op:plugin_activate] +termix | [11:49:44 PM] [INFO] [🧩] Mounted /plugin-api/workspaces [op:plugin_http_mount] +termix | [11:49:44 PM] [INFO] [🧩] Workspaces routes mounted at /plugin-api/workspaces [op:plugin:workspaces] +termix | [11:49:44 PM] [SUCCESS] [🧩] Activated plugin workspaces [op:plugin_activate] +termix | [11:49:44 PM] [INFO] [🚀] Loaded 20 plugin(s) [op:plugin_init] +termix | [11:49:44 PM] [SUCCESS] [🚀] Termix backend started successfully [op:backend_init_complete,duration:2714ms] diff --git a/documentation/audits/security-2026-11-02/bench/termix/to-states.json b/documentation/audits/security-2026-11-02/bench/termix/to-states.json new file mode 100644 index 00000000..6a39e4b3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/to-states.json @@ -0,0 +1,8 @@ +{ + "termix": { + "status": "running", + "health": "healthy", + "restarts": 0, + "exit": 0 + } +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/bench/termix/verdict.json b/documentation/audits/security-2026-11-02/bench/termix/verdict.json new file mode 100644 index 00000000..02bcc6c6 --- /dev/null +++ b/documentation/audits/security-2026-11-02/bench/termix/verdict.json @@ -0,0 +1,58 @@ +{ + "harness_version": 5, + "edge": "MV-termix", + "app": "termix", + "note": "night 2026-09-23 within-a-major move: termix=ghcr.io/lukegus/termix:26.11.0", + "from": { + "termix": "ghcr.io/lukegus/termix:26.10.5" + }, + "to": { + "termix": "ghcr.io/lukegus/termix:26.11.0" + }, + "verdict": "proven", + "seed_read_before": true, + "seed_read_after": true, + "healthy_after": true, + "migration_observed": "\u001b[2Ktermix | [11:49:42 PM] [INFO] [\ud83d\uddc4\ufe0f] Database layer pre-upgrade backup created [op:database_layer_preupgrade_backup_created]", + "abort": "starts-and-serves", + "abort_detail": null, + "engine_state_after": null, + "memory": { + "soak_s": 605.6, + "requested_s": 600, + "requests": 12029, + "codes": { + "200": 12029 + }, + "first_kill": null, + "containers": { + "termix": { + "limit": 268435456, + "peak": 268435456, + "peak_pct": 1.0, + "anon_peak_sampled": 100642816, + "anon_peak_pct": 0.375, + "anon_live_peak_sampled": 100642816, + "anon_live_peak_pct": 0.375, + "swap_peak": 0, + "oom_kills": 0, + "restarts": 0, + "oomkilled_flag": false, + "measured": true + } + }, + "unmeasured": [], + "venue_swap_bytes": 0, + "load": "reached" + }, + "marks": [], + "bench_overrides": null, + "duration_s": 30.9, + "measured_at": "2026-11-02T23:00:38Z", + "evidence": "evidence/MV-termix", + "scratch_cleared": [], + "files_changed": [], + "files_changed_detail": [], + "files_ignored": [], + "total_s": 730.2 +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/part1/dry-2549-runner-after.log b/documentation/audits/security-2026-11-02/part1/dry-2549-runner-after.log new file mode 100644 index 00000000..5dc35cbd --- /dev/null +++ b/documentation/audits/security-2026-11-02/part1/dry-2549-runner-after.log @@ -0,0 +1,257 @@ +2026-11-02T21:42:11.8218349Z felhom-gates-runner(version:v0.6.1) received task 2577 of job watch, be triggered by event: workflow_dispatch +2026-11-02T21:42:11.8226017Z workflow prepared +2026-11-02T21:42:11.8228212Z evaluating expression 'always()' +2026-11-02T21:42:11.8230352Z expression 'always()' evaluated to 'true' +2026-11-02T21:42:11.8240343Z evaluating expression '' +2026-11-02T21:42:11.8240816Z expression '' evaluated to 'true' +2026-11-02T21:42:11.8241211Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos +2026-11-02T21:42:11.8246004Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' +2026-11-02T21:42:11.8247656Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T21:42:11.8248006Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T21:42:11.8248283Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin +2026-11-02T21:42:11.8248508Z git init -q . && git remote add origin $base/felhom.eu.git +2026-11-02T21:42:11.8248749Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +2026-11-02T21:42:11.8248972Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" +2026-11-02T21:42:11.8249195Z for r in felhom-controller app-catalog-felhom.eu; do +2026-11-02T21:42:11.8249353Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git +2026-11-02T21:42:11.8249477Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD +2026-11-02T21:42:11.8249592Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" +2026-11-02T21:42:11.8249704Z done +2026-11-02T21:42:11.8249925Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T21:42:11.8250126Z ::endgroup:: +2026-11-02T21:42:29.8169753Z felhom.eu main at 4afa8c3cdee1 +2026-11-02T21:42:33.9310388Z felhom-controller at a90b62323f11 +2026-11-02T21:42:34.6718276Z app-catalog-felhom.eu at 313eaf68d01f +2026-11-02T21:42:34.6787958Z ::group::Run set -u +2026-11-02T21:42:34.6788384Z set -u +2026-11-02T21:42:34.6788610Z mkdir -p documentation/security-watch +2026-11-02T21:42:34.6789174Z mode="${MODE:-run}" +2026-11-02T21:42:34.6789447Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run +2026-11-02T21:42:34.6789663Z echo "mode: $mode" +2026-11-02T21:42:34.6789880Z case "$mode" in +2026-11-02T21:42:34.6790071Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; +2026-11-02T21:42:34.6790294Z dry) extra="--no-mail" ; state=/tmp/state-dry.json +2026-11-02T21:42:34.6790510Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; +2026-11-02T21:42:34.6790731Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;; +2026-11-02T21:42:34.6790979Z run) extra="" ; state=documentation/security-watch/state.json ;; +2026-11-02T21:42:34.6791193Z *) echo "unknown mode $mode"; exit 2 ;; +2026-11-02T21:42:34.6791391Z esac +2026-11-02T21:42:34.6791565Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ +2026-11-02T21:42:34.6791967Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra +2026-11-02T21:42:34.6792232Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T21:42:34.6792611Z env: +2026-11-02T21:42:34.6792980Z RESEND_API_KEY: *** +2026-11-02T21:42:34.6793192Z GH_ADVISORY_TOKEN: *** +2026-11-02T21:42:34.6793401Z MODE: dry +2026-11-02T21:42:34.6793607Z FELHOM_WHEEL_FETCH: 1 +2026-11-02T21:42:34.6793786Z ::endgroup:: +2026-11-02T21:42:34.6833273Z mode: dry +2026-11-02T21:42:34.9145767Z /root/.cache/act/335968a241d5ca76/hostexecutor/scripts/security_watch.py:1024: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). +2026-11-02T21:42:34.9146490Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() +2026-11-02T21:42:34.9735576Z security watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight +2026-11-02T21:48:22.5239954Z ADVISORY doop actualbudget/actual-server 26.10.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5241204Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5241478Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5) +2026-11-02T21:48:22.5241761Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0) +2026-11-02T21:48:22.5241957Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5242206Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:48:22.5242392Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T21:48:22.5242782Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2) +2026-11-02T21:48:22.5261079Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more +2026-11-02T21:48:22.5261438Z ADVISORY doop getmeili/meilisearch v1.11.3 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:48:22.5261699Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4) +2026-11-02T21:48:22.5261906Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more +2026-11-02T21:48:22.5262289Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more +2026-11-02T21:48:22.5262509Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1) +2026-11-02T21:48:22.5262659Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:48:22.5262810Z ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 145 more +2026-11-02T21:48:22.5263014Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T21:48:22.5263222Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more +2026-11-02T21:48:22.5263396Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more +2026-11-02T21:48:22.5263765Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more +2026-11-02T21:48:22.5263981Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more +2026-11-02T21:48:22.5264310Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5264482Z ADVISORY box traefik v3.7.16 GHSA-xv5x-242w-7hf7 (fixed v3.7.17) +2026-11-02T21:48:22.5264617Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5264751Z ADVISORY doop vaultwarden/server 1.37.4 GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T21:48:22.5264887Z ADVISORY app actualbudget/actual-server 26.9.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5265507Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T21:48:22.5265725Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)) +2026-11-02T21:48:22.5265899Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5266075Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:48:22.5266203Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more +2026-11-02T21:48:22.5266392Z ADVISORY app getmeili/meilisearch v1.41.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:48:22.5266555Z ADVISORY app getmeili/meilisearch v1.36.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:48:22.5266703Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T21:48:22.5266869Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T21:48:22.5267072Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet) +2026-11-02T21:48:22.5267245Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6) +2026-11-02T21:48:22.5267390Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0) +2026-11-02T21:48:22.5267541Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1) +2026-11-02T21:48:22.5267690Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand) +2026-11-02T21:48:22.5267858Z ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more +2026-11-02T21:48:22.5268046Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7) +2026-11-02T21:48:22.5268219Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T21:48:22.5268421Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand) +2026-11-02T21:48:22.5268573Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more +2026-11-02T21:48:22.5269015Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1) +2026-11-02T21:48:22.5269975Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:48:22.5270226Z ADVISORY app vaultwarden/server 1.37.4-alpine GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T21:48:22.5270399Z BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11 +2026-11-02T21:48:22.5270562Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2 +2026-11-02T21:48:22.5270702Z BEHIND app freikin/dawarich 1.19.0 newest 1.20.1 +2026-11-02T21:48:22.5270864Z BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11 +2026-11-02T21:48:22.5271007Z BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01 +2026-11-02T21:48:22.5271173Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4 +2026-11-02T21:48:22.5271305Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0 +2026-11-02T21:48:22.5271445Z BEHIND app gotson/komga 1.28.0 newest 1.29.2 +2026-11-02T21:48:22.5271710Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0 +2026-11-02T21:48:22.5271848Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0 +2026-11-02T21:48:22.5271980Z BEHIND app lukevella/rallly 4.16.3 newest 4.16.4 +2026-11-02T21:48:22.5272101Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache +2026-11-02T21:48:22.5272269Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine +2026-11-02T21:48:22.5272409Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2 +2026-11-02T21:48:22.5272553Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T21:48:22.5272687Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T21:48:22.5272841Z GAP doop alpine/k8s 1.37.1 newest 1.37.2 +2026-11-02T21:48:22.5273000Z GAP doop arcadiatechnology/crafty-4 4.11.0 +2026-11-02T21:48:22.5273139Z GAP doop bhgedigital/envsubst latest +2026-11-02T21:48:22.5273275Z GAP doop busybox 1.38 +2026-11-02T21:48:22.5273402Z GAP doop codercom/code-server 4.143.1 newest 4.144.0 +2026-11-02T21:48:22.5273520Z GAP buil debian 13.7-slim +2026-11-02T21:48:22.5273662Z GAP buil debian 13.7-slim +2026-11-02T21:48:22.5273784Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3 +2026-11-02T21:48:22.5273902Z GAP doop docker.io/library/nextcloud 34.0.5-apache +2026-11-02T21:48:22.5274018Z GAP doop docker.io/valkey/valkey 9.2-alpine +2026-11-02T21:48:22.5274146Z GAP doop filebrowser/filebrowser v2.63.23 +2026-11-02T21:48:22.5274263Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11 +2026-11-02T21:48:22.5274391Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0 +2026-11-02T21:48:22.5274745Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0 +2026-11-02T21:48:22.5274903Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0 +2026-11-02T21:48:22.5275051Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0 +2026-11-02T21:48:22.5275211Z GAP doop ghcr.io/seriousm4x/upsnap 5 +2026-11-02T21:48:22.5275361Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23 +2026-11-02T21:48:22.5275529Z GAP doop ghcr.io/tautulli/tautulli v2.18.2 +2026-11-02T21:48:22.5275657Z GAP doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 +2026-11-02T21:48:22.5275810Z GAP doop gitea.dooplex.hu/admin/jarr latest +2026-11-02T21:48:22.5275951Z GAP doop gitea.dooplex.hu/admin/recipe-importer latest +2026-11-02T21:48:22.5276082Z GAP doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 +2026-11-02T21:48:22.5276218Z GAP doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 +2026-11-02T21:48:22.5276348Z GAP doop gitea.dooplex.hu/admin/wan-probe 0.1.0 +2026-11-02T21:48:22.5276463Z GAP doop griefed/serverpackcreator 8.1.2 +2026-11-02T21:48:22.5276597Z GAP doop gtstef/filebrowser 1.5.8-stable +2026-11-02T21:48:22.5276715Z GAP doop guacamole/guacamole 1.6.0 +2026-11-02T21:48:22.5276840Z GAP doop guacamole/guacd 1.6.0 +2026-11-02T21:48:22.5276959Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T21:48:22.5277095Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3 +2026-11-02T21:48:22.5277248Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17 +2026-11-02T21:48:22.5277414Z GAP doop linuxserver/bookstack 26.09.20260929 +2026-11-02T21:48:22.5277561Z GAP doop linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T21:48:22.5277694Z GAP doop linuxserver/qbittorrent 5.3.0 +2026-11-02T21:48:22.5277812Z GAP doop linuxserver/radarr version-6.4.4.10685 +2026-11-02T21:48:22.5277921Z GAP doop linuxserver/sonarr version-4.0.20.3014 +2026-11-02T21:48:22.5278033Z GAP doop mariadb 11 +2026-11-02T21:48:22.5278161Z GAP doop mikefarah/yq 4.54.1 +2026-11-02T21:48:22.5278282Z GAP doop minio/minio latest +2026-11-02T21:48:22.5278412Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204 +2026-11-02T21:48:22.5278536Z GAP doop msdeluise/plant-it-server 0.10.0 +2026-11-02T21:48:22.5278647Z GAP doop mysql 8.4 +2026-11-02T21:48:22.5278758Z GAP doop nicolaka/netshoot latest +2026-11-02T21:48:22.5278868Z GAP doop postgis/postgis 16-3.5 +2026-11-02T21:48:22.5278996Z GAP doop postgres 15-alpine +2026-11-02T21:48:22.5279107Z GAP doop postgres 16-alpine +2026-11-02T21:48:22.5279230Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0 +2026-11-02T21:48:22.5279360Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2 +2026-11-02T21:48:22.5279490Z GAP doop prom/node-exporter v1.12.1 +2026-11-02T21:48:22.5279608Z GAP doop prom/prometheus v3.15.0 newest v3.15.1 +2026-11-02T21:48:22.5279733Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0 +2026-11-02T21:48:22.5279864Z GAP doop python 3.15-bookworm +2026-11-02T21:48:22.5279985Z GAP doop quay.io/jetstack/version-checker v0.11.0 +2026-11-02T21:48:22.5280098Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1 +2026-11-02T21:48:22.5280405Z GAP doop renovate/renovate 44.181.1 newest 44.206.0 +2026-11-02T21:48:22.5280547Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4 +2026-11-02T21:48:22.5280668Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13 +2026-11-02T21:48:22.5280792Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg +2026-11-02T21:48:22.5280932Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 +2026-11-02T21:48:22.5281048Z GAP app mariadb 12.3 +2026-11-02T21:48:22.5281161Z GAP app mariadb 11.4 newest 11.8 +2026-11-02T21:48:22.5281283Z GAP app mariadb 11.8 +2026-11-02T21:48:22.5281396Z GAP app mariadb 12.3 +2026-11-02T21:48:22.5281510Z GAP app mariadb 11.8 +2026-11-02T21:48:22.5281615Z GAP app msdeluise/plant-it 0.10.0 +2026-11-02T21:48:22.5281746Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T21:48:22.5281855Z GAP app postgis/postgis 16-3.5-alpine +2026-11-02T21:48:22.5281963Z GAP app postgis/postgis 17-3.5-alpine +2026-11-02T21:48:22.5282073Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282182Z GAP app postgres 17-alpine +2026-11-02T21:48:22.5282376Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282494Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282614Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282726Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282829Z GAP app postgres 18-alpine +2026-11-02T21:48:22.5282947Z GAP app postgres 17-alpine +2026-11-02T21:48:22.5283067Z GAP app postgres 16-alpine +2026-11-02T21:48:22.5283194Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 +2026-11-02T21:48:22.5283321Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest +2026-11-02T21:48:22.5283656Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest +2026-11-02T21:48:22.5283787Z FLOATING doop nginx 1.31-alpine +2026-11-02T21:48:22.5283895Z FLOATING doop redis 8-alpine +2026-11-02T21:48:22.5284017Z FLOATING doop redis 8.10-alpine +2026-11-02T21:48:22.5284142Z FLOATING app ghcr.io/claperco/claper 2.5 +2026-11-02T21:48:22.5284256Z FLOATING app ghcr.io/thomiceli/opengist 1.15 +2026-11-02T21:48:22.5284372Z FLOATING app jellyfin/jellyfin 12.4 +2026-11-02T21:48:22.5284499Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T21:48:22.5284624Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 +2026-11-02T21:48:22.5284744Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 +2026-11-02T21:48:22.5284876Z FLOATING app nzbgetcom/nzbget v26.3 +2026-11-02T21:48:22.5284988Z FLOATING app redis 7.4-alpine +2026-11-02T21:48:22.5285107Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285222Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285348Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285456Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285574Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285686Z FLOATING app redis 7-alpine +2026-11-02T21:48:22.5285801Z FLOATING app wger/server 2.7 +2026-11-02T21:48:22.5285927Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 +2026-11-02T21:48:22.5286043Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 +2026-11-02T21:48:22.5286171Z CURRENT doop f0rc3/gokapi v2.2.4 +2026-11-02T21:48:22.5286293Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T21:48:22.5286407Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3 +2026-11-02T21:48:22.5286568Z CURRENT doop glanceapp/glance v0.8.7 +2026-11-02T21:48:22.5286689Z CURRENT buil golang 1.27.3-trixie +2026-11-02T21:48:22.5286804Z CURRENT buil golang 1.27.3-alpine3.24 +2026-11-02T21:48:22.5286922Z CURRENT doop onlyoffice/documentserver 9.4.0 +2026-11-02T21:48:22.5287063Z CURRENT buil restic 0.19.1 +2026-11-02T21:48:22.5287177Z CURRENT app deluan/navidrome 0.64.2 +2026-11-02T21:48:22.5287291Z CURRENT app docmost/docmost 0.97.0 +2026-11-02T21:48:22.5287407Z CURRENT app flomp/wanderer-db v0.21.2 +2026-11-02T21:48:22.5287523Z CURRENT app flomp/wanderer-web v0.21.2 +2026-11-02T21:48:22.5287630Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2 +2026-11-02T21:48:22.5287744Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0 +2026-11-02T21:48:22.5287871Z CURRENT app ghcr.io/diced/zipline 4.8.2 +2026-11-02T21:48:22.5287997Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0 +2026-11-02T21:48:22.5288114Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0 +2026-11-02T21:48:22.5288233Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0 +2026-11-02T21:48:22.5288351Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4 +2026-11-02T21:48:22.5288475Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless +2026-11-02T21:48:22.5288587Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1 +2026-11-02T21:48:22.5288718Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1 +2026-11-02T21:48:22.5288838Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T21:48:22.5288953Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1 +2026-11-02T21:48:22.5289068Z CURRENT app ghost 6.73.0-alpine +2026-11-02T21:48:22.5289192Z CURRENT app lscr.io/linuxserver/bookstack 26.09.2 +2026-11-02T21:48:22.5289310Z CURRENT app lscr.io/linuxserver/grocy 4.7.1 +2026-11-02T21:48:22.5289542Z CURRENT app lscr.io/linuxserver/radarr 6.4.4 +2026-11-02T21:48:22.5289706Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20 +2026-11-02T21:48:22.5289826Z CURRENT app onlyoffice/documentserver 9.4.0 +2026-11-02T21:48:22.5289943Z CURRENT app outlinewiki/outline 1.12.0 +2026-11-02T21:48:22.5290130Z CURRENT app vikunja/vikunja 2.7.1 +2026-11-02T21:48:22.5290511Z COUNTS ADVISORY=48 BEHIND=14 CURRENT=32 FLOATING=20 GAP=81 SELF=2 +2026-11-02T21:48:22.5290749Z FAILED-SOURCES 0 +2026-11-02T21:48:22.5290855Z RUNTIME read=0 (0 s) from-cache=185 not-checked=0 stated-unreadable=10 zstd-decoder=not needed +2026-11-02T21:48:22.5290996Z TAGS fetched=118 from-cache=0 retried-429=12 retried-timeout=1 (cache /root/.cache/felhom-watch-tags.json) +2026-11-02T21:48:22.5291141Z REQUESTS api.github.com=69 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=63 hub.docker.com=221 raw.githubusercontent.com=1 registry-1.docker.io=1 +2026-11-02T21:48:22.5562145Z MAIL (not sent, --no-mail): [Felhom security] traefik, actual-server, meilisearch, uptime-kuma … — 13 new advisories +2026-11-02T21:48:22.5684776Z STATE written: /tmp/state-dry.json (364 known advisories) +2026-11-02T21:48:22.6533683Z Cleaning up container for job watch +2026-11-02T21:48:23.2226765Z 🏁 Job succeeded diff --git a/documentation/audits/security-2026-11-02/part1/dry-2554-runner-after.log b/documentation/audits/security-2026-11-02/part1/dry-2554-runner-after.log new file mode 100644 index 00000000..a8da232d --- /dev/null +++ b/documentation/audits/security-2026-11-02/part1/dry-2554-runner-after.log @@ -0,0 +1,257 @@ +2026-11-02T22:32:03.3624348Z felhom-gates-runner(version:v0.6.1) received task 2582 of job watch, be triggered by event: workflow_dispatch +2026-11-02T22:32:03.3631338Z workflow prepared +2026-11-02T22:32:03.3632476Z evaluating expression 'always()' +2026-11-02T22:32:03.3633705Z expression 'always()' evaluated to 'true' +2026-11-02T22:32:03.3640320Z evaluating expression '' +2026-11-02T22:32:03.3640825Z expression '' evaluated to 'true' +2026-11-02T22:32:03.3641017Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos +2026-11-02T22:32:03.3649824Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' +2026-11-02T22:32:03.3651162Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T22:32:03.3651408Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T22:32:03.3651699Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin +2026-11-02T22:32:03.3651831Z git init -q . && git remote add origin $base/felhom.eu.git +2026-11-02T22:32:03.3652015Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +2026-11-02T22:32:03.3652133Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" +2026-11-02T22:32:03.3652240Z for r in felhom-controller app-catalog-felhom.eu; do +2026-11-02T22:32:03.3652347Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git +2026-11-02T22:32:03.3652503Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD +2026-11-02T22:32:03.3652662Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" +2026-11-02T22:32:03.3652769Z done +2026-11-02T22:32:03.3652860Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T22:32:03.3653007Z ::endgroup:: +2026-11-02T22:32:18.1354082Z felhom.eu main at 2f7e836f6818 +2026-11-02T22:32:20.2163227Z felhom-controller at c4b6844d340e +2026-11-02T22:32:20.6219635Z app-catalog-felhom.eu at 313eaf68d01f +2026-11-02T22:32:20.6236829Z ::group::Run set -u +2026-11-02T22:32:20.6237000Z set -u +2026-11-02T22:32:20.6237093Z mkdir -p documentation/security-watch +2026-11-02T22:32:20.6237204Z mode="${MODE:-run}" +2026-11-02T22:32:20.6237304Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run +2026-11-02T22:32:20.6237392Z echo "mode: $mode" +2026-11-02T22:32:20.6237467Z case "$mode" in +2026-11-02T22:32:20.6237563Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; +2026-11-02T22:32:20.6237655Z dry) extra="--no-mail" ; state=/tmp/state-dry.json +2026-11-02T22:32:20.6237741Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; +2026-11-02T22:32:20.6237837Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;; +2026-11-02T22:32:20.6237946Z run) extra="" ; state=documentation/security-watch/state.json ;; +2026-11-02T22:32:20.6238050Z *) echo "unknown mode $mode"; exit 2 ;; +2026-11-02T22:32:20.6238134Z esac +2026-11-02T22:32:20.6238218Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ +2026-11-02T22:32:20.6238322Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra +2026-11-02T22:32:20.6238418Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T22:32:20.6238531Z env: +2026-11-02T22:32:20.6238618Z RESEND_API_KEY: *** +2026-11-02T22:32:20.6238710Z GH_ADVISORY_TOKEN: *** +2026-11-02T22:32:20.6238809Z MODE: dry +2026-11-02T22:32:20.6238908Z FELHOM_WHEEL_FETCH: 1 +2026-11-02T22:32:20.6238986Z ::endgroup:: +2026-11-02T22:32:20.6265581Z mode: dry +2026-11-02T22:32:20.7932512Z /root/.cache/act/b337d75bad88b410/hostexecutor/scripts/security_watch.py:1024: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). +2026-11-02T22:32:20.7933236Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() +2026-11-02T22:32:20.8429558Z security watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight +2026-11-02T22:32:29.5767349Z RUNTIME-READ traefik:v3.7.17 6 s ok +2026-11-02T22:33:15.4609266Z ADVISORY doop actualbudget/actual-server 26.10.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4609979Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4610316Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5) +2026-11-02T22:33:15.4611715Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0) +2026-11-02T22:33:15.4612178Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4612457Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:33:15.4612745Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T22:33:15.4613012Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2) +2026-11-02T22:33:15.4613351Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more +2026-11-02T22:33:15.4613709Z ADVISORY doop getmeili/meilisearch v1.11.3 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:33:15.4614074Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4) +2026-11-02T22:33:15.4614310Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more +2026-11-02T22:33:15.4614586Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more +2026-11-02T22:33:15.4614942Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1) +2026-11-02T22:33:15.4615153Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:33:15.4615375Z ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 145 more +2026-11-02T22:33:15.4615738Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T22:33:15.4616070Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more +2026-11-02T22:33:15.4616348Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more +2026-11-02T22:33:15.4616638Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more +2026-11-02T22:33:15.4617015Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more +2026-11-02T22:33:15.4617326Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4617621Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4617887Z ADVISORY doop vaultwarden/server 1.37.4 GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T22:33:15.4618119Z ADVISORY app actualbudget/actual-server 26.9.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4618469Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T22:33:15.4618729Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)) +2026-11-02T22:33:15.4619044Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4619344Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:33:15.4619545Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more +2026-11-02T22:33:15.4619828Z ADVISORY app getmeili/meilisearch v1.41.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:33:15.4620077Z ADVISORY app getmeili/meilisearch v1.36.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:33:15.4620351Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T22:33:15.4620576Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T22:33:15.4621038Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet) +2026-11-02T22:33:15.4621262Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6) +2026-11-02T22:33:15.4621488Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0) +2026-11-02T22:33:15.4621796Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1) +2026-11-02T22:33:15.4622044Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand) +2026-11-02T22:33:15.4622390Z ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more +2026-11-02T22:33:15.4622674Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7) +2026-11-02T22:33:15.4622945Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T22:33:15.4623223Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand) +2026-11-02T22:33:15.4623856Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more +2026-11-02T22:33:15.4624295Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1) +2026-11-02T22:33:15.4624628Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:33:15.4624821Z ADVISORY app vaultwarden/server 1.37.4-alpine GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T22:33:15.4625027Z BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11 +2026-11-02T22:33:15.4625253Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2 +2026-11-02T22:33:15.4625489Z BEHIND app freikin/dawarich 1.19.0 newest 1.20.1 +2026-11-02T22:33:15.4625692Z BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11 +2026-11-02T22:33:15.4625934Z BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01 +2026-11-02T22:33:15.4626159Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4 +2026-11-02T22:33:15.4626394Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0 +2026-11-02T22:33:15.4626585Z BEHIND app gotson/komga 1.28.0 newest 1.29.2 +2026-11-02T22:33:15.4626805Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0 +2026-11-02T22:33:15.4626995Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0 +2026-11-02T22:33:15.4627316Z BEHIND app lukevella/rallly 4.16.3 newest 4.16.4 +2026-11-02T22:33:15.4627663Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache +2026-11-02T22:33:15.4627856Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine +2026-11-02T22:33:15.4628087Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2 +2026-11-02T22:33:15.4628292Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T22:33:15.4628507Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T22:33:15.4628687Z GAP doop alpine/k8s 1.37.1 newest 1.37.2 +2026-11-02T22:33:15.4629275Z GAP doop arcadiatechnology/crafty-4 4.11.0 +2026-11-02T22:33:15.4629516Z GAP doop bhgedigital/envsubst latest +2026-11-02T22:33:15.4629710Z GAP doop busybox 1.38 +2026-11-02T22:33:15.4629940Z GAP doop codercom/code-server 4.143.1 newest 4.144.0 +2026-11-02T22:33:15.4630140Z GAP buil debian 13.7-slim +2026-11-02T22:33:15.4630378Z GAP buil debian 13.7-slim +2026-11-02T22:33:15.4630643Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3 +2026-11-02T22:33:15.4630874Z GAP doop docker.io/library/nextcloud 34.0.5-apache +2026-11-02T22:33:15.4631206Z GAP doop docker.io/valkey/valkey 9.2-alpine +2026-11-02T22:33:15.4631468Z GAP doop filebrowser/filebrowser v2.63.23 +2026-11-02T22:33:15.4631702Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11 +2026-11-02T22:33:15.4631892Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0 +2026-11-02T22:33:15.4632109Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0 +2026-11-02T22:33:15.4632458Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0 +2026-11-02T22:33:15.4632697Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0 +2026-11-02T22:33:15.4632973Z GAP doop ghcr.io/seriousm4x/upsnap 5 +2026-11-02T22:33:15.4633214Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23 +2026-11-02T22:33:15.4633412Z GAP doop ghcr.io/tautulli/tautulli v2.18.2 +2026-11-02T22:33:15.4633831Z GAP doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 +2026-11-02T22:33:15.4634068Z GAP doop gitea.dooplex.hu/admin/jarr latest +2026-11-02T22:33:15.4634251Z GAP doop gitea.dooplex.hu/admin/recipe-importer latest +2026-11-02T22:33:15.4634435Z GAP doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 +2026-11-02T22:33:15.4634654Z GAP doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 +2026-11-02T22:33:15.4634876Z GAP doop gitea.dooplex.hu/admin/wan-probe 0.1.0 +2026-11-02T22:33:15.4635146Z GAP doop griefed/serverpackcreator 8.1.2 +2026-11-02T22:33:15.4635330Z GAP doop gtstef/filebrowser 1.5.8-stable +2026-11-02T22:33:15.4635605Z GAP doop guacamole/guacamole 1.6.0 +2026-11-02T22:33:15.4635827Z GAP doop guacamole/guacd 1.6.0 +2026-11-02T22:33:15.4636006Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T22:33:15.4636198Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3 +2026-11-02T22:33:15.4636386Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17 +2026-11-02T22:33:15.4636617Z GAP doop linuxserver/bookstack 26.09.20260929 +2026-11-02T22:33:15.4636793Z GAP doop linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T22:33:15.4636987Z GAP doop linuxserver/qbittorrent 5.3.0 +2026-11-02T22:33:15.4637171Z GAP doop linuxserver/radarr version-6.4.4.10685 +2026-11-02T22:33:15.4637490Z GAP doop linuxserver/sonarr version-4.0.20.3014 +2026-11-02T22:33:15.4637721Z GAP doop mariadb 11 +2026-11-02T22:33:15.4637903Z GAP doop mikefarah/yq 4.54.1 +2026-11-02T22:33:15.4638129Z GAP doop minio/minio latest +2026-11-02T22:33:15.4638333Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204 +2026-11-02T22:33:15.4640218Z GAP doop msdeluise/plant-it-server 0.10.0 +2026-11-02T22:33:15.4640708Z GAP doop mysql 8.4 +2026-11-02T22:33:15.4640960Z GAP doop nicolaka/netshoot latest +2026-11-02T22:33:15.4641199Z GAP doop postgis/postgis 16-3.5 +2026-11-02T22:33:15.4641407Z GAP doop postgres 15-alpine +2026-11-02T22:33:15.4641669Z GAP doop postgres 16-alpine +2026-11-02T22:33:15.4641875Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0 +2026-11-02T22:33:15.4642215Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2 +2026-11-02T22:33:15.4642559Z GAP doop prom/node-exporter v1.12.1 +2026-11-02T22:33:15.4642761Z GAP doop prom/prometheus v3.15.0 newest v3.15.1 +2026-11-02T22:33:15.4643073Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0 +2026-11-02T22:33:15.4643288Z GAP doop python 3.15-bookworm +2026-11-02T22:33:15.4643530Z GAP doop quay.io/jetstack/version-checker v0.11.0 +2026-11-02T22:33:15.4643730Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1 +2026-11-02T22:33:15.4643945Z GAP doop renovate/renovate 44.181.1 newest 44.206.0 +2026-11-02T22:33:15.4644284Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4 +2026-11-02T22:33:15.4644452Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13 +2026-11-02T22:33:15.4644642Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg +2026-11-02T22:33:15.4644845Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 +2026-11-02T22:33:15.4645099Z GAP app mariadb 12.3 +2026-11-02T22:33:15.4645297Z GAP app mariadb 11.4 newest 11.8 +2026-11-02T22:33:15.4645520Z GAP app mariadb 11.8 +2026-11-02T22:33:15.4645773Z GAP app mariadb 12.3 +2026-11-02T22:33:15.4646355Z GAP app mariadb 11.8 +2026-11-02T22:33:15.4646673Z GAP app msdeluise/plant-it 0.10.0 +2026-11-02T22:33:15.4646959Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T22:33:15.4647182Z GAP app postgis/postgis 16-3.5-alpine +2026-11-02T22:33:15.4647367Z GAP app postgis/postgis 17-3.5-alpine +2026-11-02T22:33:15.4647656Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4647911Z GAP app postgres 17-alpine +2026-11-02T22:33:15.4648117Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4648314Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4648512Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4648888Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4649089Z GAP app postgres 18-alpine +2026-11-02T22:33:15.4649284Z GAP app postgres 17-alpine +2026-11-02T22:33:15.4649549Z GAP app postgres 16-alpine +2026-11-02T22:33:15.4649845Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 +2026-11-02T22:33:15.4650054Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest +2026-11-02T22:33:15.4650281Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest +2026-11-02T22:33:15.4650525Z FLOATING doop nginx 1.31-alpine +2026-11-02T22:33:15.4650724Z FLOATING doop redis 8-alpine +2026-11-02T22:33:15.4651085Z FLOATING doop redis 8.10-alpine +2026-11-02T22:33:15.4651327Z FLOATING app ghcr.io/claperco/claper 2.5 +2026-11-02T22:33:15.4651529Z FLOATING app ghcr.io/thomiceli/opengist 1.15 +2026-11-02T22:33:15.4651723Z FLOATING app jellyfin/jellyfin 12.4 +2026-11-02T22:33:15.4652011Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T22:33:15.4652271Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 +2026-11-02T22:33:15.4652478Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 +2026-11-02T22:33:15.4652711Z FLOATING app nzbgetcom/nzbget v26.3 +2026-11-02T22:33:15.4653004Z FLOATING app redis 7.4-alpine +2026-11-02T22:33:15.4653206Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4653398Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4653590Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4653825Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4654019Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4654213Z FLOATING app redis 7-alpine +2026-11-02T22:33:15.4654444Z FLOATING app wger/server 2.7 +2026-11-02T22:33:15.4654661Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 +2026-11-02T22:33:15.4654852Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 +2026-11-02T22:33:15.4655049Z CURRENT doop f0rc3/gokapi v2.2.4 +2026-11-02T22:33:15.4655297Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T22:33:15.4655517Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3 +2026-11-02T22:33:15.4655682Z CURRENT doop glanceapp/glance v0.8.7 +2026-11-02T22:33:15.4655848Z CURRENT buil golang 1.27.3-trixie +2026-11-02T22:33:15.4656012Z CURRENT buil golang 1.27.3-alpine3.24 +2026-11-02T22:33:15.4656307Z CURRENT doop onlyoffice/documentserver 9.4.0 +2026-11-02T22:33:15.4656516Z CURRENT buil restic 0.19.1 +2026-11-02T22:33:15.4656711Z CURRENT box traefik v3.7.17 +2026-11-02T22:33:15.4657085Z CURRENT app deluan/navidrome 0.64.2 +2026-11-02T22:33:15.4657302Z CURRENT app docmost/docmost 0.97.0 +2026-11-02T22:33:15.4657515Z CURRENT app flomp/wanderer-db v0.21.2 +2026-11-02T22:33:15.4657750Z CURRENT app flomp/wanderer-web v0.21.2 +2026-11-02T22:33:15.4657949Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2 +2026-11-02T22:33:15.4658172Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0 +2026-11-02T22:33:15.4658362Z CURRENT app ghcr.io/diced/zipline 4.8.2 +2026-11-02T22:33:15.4658567Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0 +2026-11-02T22:33:15.4658777Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0 +2026-11-02T22:33:15.4659074Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0 +2026-11-02T22:33:15.4659287Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4 +2026-11-02T22:33:15.4659488Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless +2026-11-02T22:33:15.4659688Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1 +2026-11-02T22:33:15.4659902Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1 +2026-11-02T22:33:15.4660112Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T22:33:15.4660286Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1 +2026-11-02T22:33:15.4660454Z CURRENT app ghost 6.73.0-alpine +2026-11-02T22:33:15.4660665Z CURRENT app lscr.io/linuxserver/bookstack 26.09.2 +2026-11-02T22:33:15.4660865Z CURRENT app lscr.io/linuxserver/grocy 4.7.1 +2026-11-02T22:33:15.4661163Z CURRENT app lscr.io/linuxserver/radarr 6.4.4 +2026-11-02T22:33:15.4661369Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20 +2026-11-02T22:33:15.4661576Z CURRENT app onlyoffice/documentserver 9.4.0 +2026-11-02T22:33:15.4661775Z CURRENT app outlinewiki/outline 1.12.0 +2026-11-02T22:33:15.4662024Z CURRENT app vikunja/vikunja 2.7.1 +2026-11-02T22:33:15.4662236Z COUNTS ADVISORY=47 BEHIND=14 CURRENT=33 FLOATING=20 GAP=81 SELF=2 +2026-11-02T22:33:15.4662427Z FAILED-SOURCES 0 +2026-11-02T22:33:17.5956062Z RUNTIME read=1 (6 s) from-cache=184 not-checked=0 stated-unreadable=10 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked) +2026-11-02T22:33:17.5957090Z TAGS fetched=0 from-cache=116 retried-429=0 retried-timeout=0 (cache /root/.cache/felhom-watch-tags.json) +2026-11-02T22:33:17.5957367Z REQUESTS api.github.com=71 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 github.com=64 hub.docker.com=1 raw.githubusercontent.com=1 registry-1.docker.io=1 +2026-11-02T22:33:17.6394663Z STATE written: /tmp/state-dry.json (363 known advisories) +2026-11-02T22:33:17.7504535Z Cleaning up container for job watch +2026-11-02T22:33:18.4005673Z 🏁 Job succeeded diff --git a/documentation/audits/security-2026-11-02/part1/dry-2555-runner2-after.log b/documentation/audits/security-2026-11-02/part1/dry-2555-runner2-after.log new file mode 100644 index 00000000..fc41e057 --- /dev/null +++ b/documentation/audits/security-2026-11-02/part1/dry-2555-runner2-after.log @@ -0,0 +1,257 @@ +2026-11-02T22:39:42.9349140Z felhom-gates-runner-2(version:v0.6.1) received task 2583 of job watch, be triggered by event: workflow_dispatch +2026-11-02T22:39:42.9354789Z workflow prepared +2026-11-02T22:39:42.9356058Z evaluating expression 'always()' +2026-11-02T22:39:42.9357037Z expression 'always()' evaluated to 'true' +2026-11-02T22:39:42.9364484Z evaluating expression '' +2026-11-02T22:39:42.9364966Z expression '' evaluated to 'true' +2026-11-02T22:39:42.9365128Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos +2026-11-02T22:39:42.9369097Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' +2026-11-02T22:39:42.9370320Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T22:39:42.9370569Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T22:39:42.9370812Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin +2026-11-02T22:39:42.9370947Z git init -q . && git remote add origin $base/felhom.eu.git +2026-11-02T22:39:42.9371070Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +2026-11-02T22:39:42.9371208Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" +2026-11-02T22:39:42.9371328Z for r in felhom-controller app-catalog-felhom.eu; do +2026-11-02T22:39:42.9371447Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git +2026-11-02T22:39:42.9371566Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD +2026-11-02T22:39:42.9371804Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" +2026-11-02T22:39:42.9371920Z done +2026-11-02T22:39:42.9372026Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T22:39:42.9372194Z ::endgroup:: +2026-11-02T22:39:56.6719308Z felhom.eu main at 2f7e836f6818 +2026-11-02T22:40:01.5961971Z felhom-controller at c4b6844d340e +2026-11-02T22:40:02.4115183Z app-catalog-felhom.eu at 313eaf68d01f +2026-11-02T22:40:02.4146536Z ::group::Run set -u +2026-11-02T22:40:02.4146980Z set -u +2026-11-02T22:40:02.4147220Z mkdir -p documentation/security-watch +2026-11-02T22:40:02.4147440Z mode="${MODE:-run}" +2026-11-02T22:40:02.4147776Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run +2026-11-02T22:40:02.4148173Z echo "mode: $mode" +2026-11-02T22:40:02.4148523Z case "$mode" in +2026-11-02T22:40:02.4149780Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; +2026-11-02T22:40:02.4150109Z dry) extra="--no-mail" ; state=/tmp/state-dry.json +2026-11-02T22:40:02.4150345Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; +2026-11-02T22:40:02.4150716Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;; +2026-11-02T22:40:02.4151220Z run) extra="" ; state=documentation/security-watch/state.json ;; +2026-11-02T22:40:02.4151667Z *) echo "unknown mode $mode"; exit 2 ;; +2026-11-02T22:40:02.4151891Z esac +2026-11-02T22:40:02.4152196Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ +2026-11-02T22:40:02.4152632Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra +2026-11-02T22:40:02.4152883Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T22:40:02.4153195Z env: +2026-11-02T22:40:02.4153396Z RESEND_API_KEY: *** +2026-11-02T22:40:02.4153694Z GH_ADVISORY_TOKEN: *** +2026-11-02T22:40:02.4153910Z MODE: dry +2026-11-02T22:40:02.4154092Z FELHOM_WHEEL_FETCH: 1 +2026-11-02T22:40:02.4154301Z ::endgroup:: +2026-11-02T22:40:02.4195815Z mode: dry +2026-11-02T22:40:02.6070145Z /root/.cache/act/e9a2b45c5c45c00a/hostexecutor/scripts/security_watch.py:1024: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). +2026-11-02T22:40:02.6070758Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() +2026-11-02T22:40:02.6559833Z security watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight +2026-11-02T22:40:11.0039020Z RUNTIME-READ traefik:v3.7.17 6 s ok +2026-11-02T22:40:57.2572000Z ADVISORY doop actualbudget/actual-server 26.10.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2572927Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2573259Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5) +2026-11-02T22:40:57.2573706Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0) +2026-11-02T22:40:57.2574042Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2574356Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:40:57.2574671Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T22:40:57.2574930Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2) +2026-11-02T22:40:57.2575333Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more +2026-11-02T22:40:57.2575678Z ADVISORY doop getmeili/meilisearch v1.11.3 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:40:57.2575971Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4) +2026-11-02T22:40:57.2576323Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more +2026-11-02T22:40:57.2576828Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more +2026-11-02T22:40:57.2577147Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1) +2026-11-02T22:40:57.2577404Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:40:57.2577770Z ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 145 more +2026-11-02T22:40:57.2578100Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T22:40:57.2578584Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more +2026-11-02T22:40:57.2579061Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more +2026-11-02T22:40:57.2579401Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more +2026-11-02T22:40:57.2579724Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more +2026-11-02T22:40:57.2580086Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2580407Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2580685Z ADVISORY doop vaultwarden/server 1.37.4 GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T22:40:57.2580937Z ADVISORY app actualbudget/actual-server 26.9.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2582243Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T22:40:57.2582635Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)) +2026-11-02T22:40:57.2583138Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2583510Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1) +2026-11-02T22:40:57.2583808Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more +2026-11-02T22:40:57.2584171Z ADVISORY app getmeili/meilisearch v1.41.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:40:57.2584454Z ADVISORY app getmeili/meilisearch v1.36.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T22:40:57.2584797Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T22:40:57.2585143Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T22:40:57.2585526Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet) +2026-11-02T22:40:57.2585799Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6) +2026-11-02T22:40:57.2586177Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0) +2026-11-02T22:40:57.2586447Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1) +2026-11-02T22:40:57.2586722Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand) +2026-11-02T22:40:57.2587138Z ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more +2026-11-02T22:40:57.2587445Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7) +2026-11-02T22:40:57.2587719Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T22:40:57.2588152Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand) +2026-11-02T22:40:57.2588587Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more +2026-11-02T22:40:57.2589313Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1) +2026-11-02T22:40:57.2589816Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T22:40:57.2590136Z ADVISORY app vaultwarden/server 1.37.4-alpine GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T22:40:57.2590403Z BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11 +2026-11-02T22:40:57.2590682Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2 +2026-11-02T22:40:57.2590918Z BEHIND app freikin/dawarich 1.19.0 newest 1.20.1 +2026-11-02T22:40:57.2591290Z BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11 +2026-11-02T22:40:57.2591568Z BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01 +2026-11-02T22:40:57.2591831Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4 +2026-11-02T22:40:57.2592124Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0 +2026-11-02T22:40:57.2592406Z BEHIND app gotson/komga 1.28.0 newest 1.29.2 +2026-11-02T22:40:57.2592754Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0 +2026-11-02T22:40:57.2592981Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0 +2026-11-02T22:40:57.2593315Z BEHIND app lukevella/rallly 4.16.3 newest 4.16.4 +2026-11-02T22:40:57.2593577Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache +2026-11-02T22:40:57.2593806Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine +2026-11-02T22:40:57.2594131Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2 +2026-11-02T22:40:57.2594373Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T22:40:57.2594612Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T22:40:57.2594879Z GAP doop alpine/k8s 1.37.1 newest 1.37.2 +2026-11-02T22:40:57.2595156Z GAP doop arcadiatechnology/crafty-4 4.11.0 +2026-11-02T22:40:57.2595381Z GAP doop bhgedigital/envsubst latest +2026-11-02T22:40:57.2595641Z GAP doop busybox 1.38 +2026-11-02T22:40:57.2595927Z GAP doop codercom/code-server 4.143.1 newest 4.144.0 +2026-11-02T22:40:57.2596191Z GAP buil debian 13.7-slim +2026-11-02T22:40:57.2596453Z GAP buil debian 13.7-slim +2026-11-02T22:40:57.2596672Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3 +2026-11-02T22:40:57.2596950Z GAP doop docker.io/library/nextcloud 34.0.5-apache +2026-11-02T22:40:57.2597231Z GAP doop docker.io/valkey/valkey 9.2-alpine +2026-11-02T22:40:57.2597460Z GAP doop filebrowser/filebrowser v2.63.23 +2026-11-02T22:40:57.2597761Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11 +2026-11-02T22:40:57.2598040Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0 +2026-11-02T22:40:57.2598269Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0 +2026-11-02T22:40:57.2598602Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0 +2026-11-02T22:40:57.2598912Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0 +2026-11-02T22:40:57.2599139Z GAP doop ghcr.io/seriousm4x/upsnap 5 +2026-11-02T22:40:57.2599362Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23 +2026-11-02T22:40:57.2599788Z GAP doop ghcr.io/tautulli/tautulli v2.18.2 +2026-11-02T22:40:57.2600021Z GAP doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 +2026-11-02T22:40:57.2600241Z GAP doop gitea.dooplex.hu/admin/jarr latest +2026-11-02T22:40:57.2600506Z GAP doop gitea.dooplex.hu/admin/recipe-importer latest +2026-11-02T22:40:57.2600779Z GAP doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 +2026-11-02T22:40:57.2601004Z GAP doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 +2026-11-02T22:40:57.2601275Z GAP doop gitea.dooplex.hu/admin/wan-probe 0.1.0 +2026-11-02T22:40:57.2601573Z GAP doop griefed/serverpackcreator 8.1.2 +2026-11-02T22:40:57.2601912Z GAP doop gtstef/filebrowser 1.5.8-stable +2026-11-02T22:40:57.2602282Z GAP doop guacamole/guacamole 1.6.0 +2026-11-02T22:40:57.2602508Z GAP doop guacamole/guacd 1.6.0 +2026-11-02T22:40:57.2602867Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T22:40:57.2603257Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3 +2026-11-02T22:40:57.2603493Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17 +2026-11-02T22:40:57.2603785Z GAP doop linuxserver/bookstack 26.09.20260929 +2026-11-02T22:40:57.2604049Z GAP doop linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T22:40:57.2604271Z GAP doop linuxserver/qbittorrent 5.3.0 +2026-11-02T22:40:57.2604481Z GAP doop linuxserver/radarr version-6.4.4.10685 +2026-11-02T22:40:57.2604863Z GAP doop linuxserver/sonarr version-4.0.20.3014 +2026-11-02T22:40:57.2605118Z GAP doop mariadb 11 +2026-11-02T22:40:57.2605330Z GAP doop mikefarah/yq 4.54.1 +2026-11-02T22:40:57.2605598Z GAP doop minio/minio latest +2026-11-02T22:40:57.2605888Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204 +2026-11-02T22:40:57.2606163Z GAP doop msdeluise/plant-it-server 0.10.0 +2026-11-02T22:40:57.2607589Z GAP doop mysql 8.4 +2026-11-02T22:40:57.2607965Z GAP doop nicolaka/netshoot latest +2026-11-02T22:40:57.2608222Z GAP doop postgis/postgis 16-3.5 +2026-11-02T22:40:57.2608543Z GAP doop postgres 15-alpine +2026-11-02T22:40:57.2608823Z GAP doop postgres 16-alpine +2026-11-02T22:40:57.2609068Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0 +2026-11-02T22:40:57.2609705Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2 +2026-11-02T22:40:57.2610299Z GAP doop prom/node-exporter v1.12.1 +2026-11-02T22:40:57.2610813Z GAP doop prom/prometheus v3.15.0 newest v3.15.1 +2026-11-02T22:40:57.2611194Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0 +2026-11-02T22:40:57.2611494Z GAP doop python 3.15-bookworm +2026-11-02T22:40:57.2611761Z GAP doop quay.io/jetstack/version-checker v0.11.0 +2026-11-02T22:40:57.2612183Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1 +2026-11-02T22:40:57.2612776Z GAP doop renovate/renovate 44.181.1 newest 44.199.2 +2026-11-02T22:40:57.2613163Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4 +2026-11-02T22:40:57.2613391Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13 +2026-11-02T22:40:57.2613618Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg +2026-11-02T22:40:57.2613907Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 +2026-11-02T22:40:57.2614136Z GAP app mariadb 12.3 +2026-11-02T22:40:57.2614471Z GAP app mariadb 11.4 newest 11.8 +2026-11-02T22:40:57.2614759Z GAP app mariadb 11.8 +2026-11-02T22:40:57.2615090Z GAP app mariadb 12.3 +2026-11-02T22:40:57.2615307Z GAP app mariadb 11.8 +2026-11-02T22:40:57.2615515Z GAP app msdeluise/plant-it 0.10.0 +2026-11-02T22:40:57.2615893Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T22:40:57.2616111Z GAP app postgis/postgis 16-3.5-alpine +2026-11-02T22:40:57.2616325Z GAP app postgis/postgis 17-3.5-alpine +2026-11-02T22:40:57.2616593Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2616806Z GAP app postgres 17-alpine +2026-11-02T22:40:57.2617020Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2617224Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2617480Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2617686Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2617899Z GAP app postgres 18-alpine +2026-11-02T22:40:57.2618180Z GAP app postgres 17-alpine +2026-11-02T22:40:57.2618395Z GAP app postgres 16-alpine +2026-11-02T22:40:57.2618706Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 +2026-11-02T22:40:57.2618927Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest +2026-11-02T22:40:57.2619204Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest +2026-11-02T22:40:57.2619426Z FLOATING doop nginx 1.31-alpine +2026-11-02T22:40:57.2619634Z FLOATING doop redis 8-alpine +2026-11-02T22:40:57.2619911Z FLOATING doop redis 8.10-alpine +2026-11-02T22:40:57.2620128Z FLOATING app ghcr.io/claperco/claper 2.5 +2026-11-02T22:40:57.2620347Z FLOATING app ghcr.io/thomiceli/opengist 1.15 +2026-11-02T22:40:57.2620559Z FLOATING app jellyfin/jellyfin 12.4 +2026-11-02T22:40:57.2621029Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T22:40:57.2621271Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 +2026-11-02T22:40:57.2621493Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 +2026-11-02T22:40:57.2621865Z FLOATING app nzbgetcom/nzbget v26.3 +2026-11-02T22:40:57.2622080Z FLOATING app redis 7.4-alpine +2026-11-02T22:40:57.2622294Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2622504Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2622755Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2622969Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2623175Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2623447Z FLOATING app redis 7-alpine +2026-11-02T22:40:57.2623676Z FLOATING app wger/server 2.7 +2026-11-02T22:40:57.2623894Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 +2026-11-02T22:40:57.2624107Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 +2026-11-02T22:40:57.2624372Z CURRENT doop f0rc3/gokapi v2.2.4 +2026-11-02T22:40:57.2624754Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T22:40:57.2624982Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3 +2026-11-02T22:40:57.2625253Z CURRENT doop glanceapp/glance v0.8.7 +2026-11-02T22:40:57.2625466Z CURRENT buil golang 1.27.3-trixie +2026-11-02T22:40:57.2625675Z CURRENT buil golang 1.27.3-alpine3.24 +2026-11-02T22:40:57.2625882Z CURRENT doop onlyoffice/documentserver 9.4.0 +2026-11-02T22:40:57.2626253Z CURRENT buil restic 0.19.1 +2026-11-02T22:40:57.2626467Z CURRENT box traefik v3.7.17 +2026-11-02T22:40:57.2626672Z CURRENT app deluan/navidrome 0.64.2 +2026-11-02T22:40:57.2626950Z CURRENT app docmost/docmost 0.97.0 +2026-11-02T22:40:57.2627160Z CURRENT app flomp/wanderer-db v0.21.2 +2026-11-02T22:40:57.2627405Z CURRENT app flomp/wanderer-web v0.21.2 +2026-11-02T22:40:57.2627926Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2 +2026-11-02T22:40:57.2628213Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0 +2026-11-02T22:40:57.2628454Z CURRENT app ghcr.io/diced/zipline 4.8.2 +2026-11-02T22:40:57.2628667Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0 +2026-11-02T22:40:57.2629573Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0 +2026-11-02T22:40:57.2629813Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0 +2026-11-02T22:40:57.2630047Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4 +2026-11-02T22:40:57.2630261Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless +2026-11-02T22:40:57.2630481Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1 +2026-11-02T22:40:57.2630705Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1 +2026-11-02T22:40:57.2630920Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T22:40:57.2631165Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1 +2026-11-02T22:40:57.2631397Z CURRENT app ghost 6.73.0-alpine +2026-11-02T22:40:57.2631616Z CURRENT app lscr.io/linuxserver/bookstack 26.09.2 +2026-11-02T22:40:57.2631838Z CURRENT app lscr.io/linuxserver/grocy 4.7.1 +2026-11-02T22:40:57.2632179Z CURRENT app lscr.io/linuxserver/radarr 6.4.4 +2026-11-02T22:40:57.2632406Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20 +2026-11-02T22:40:57.2632619Z CURRENT app onlyoffice/documentserver 9.4.0 +2026-11-02T22:40:57.2632894Z CURRENT app outlinewiki/outline 1.12.0 +2026-11-02T22:40:57.2633129Z CURRENT app vikunja/vikunja 2.7.1 +2026-11-02T22:40:57.2633339Z COUNTS ADVISORY=47 BEHIND=14 CURRENT=33 FLOATING=20 GAP=81 SELF=2 +2026-11-02T22:40:57.2633556Z FAILED-SOURCES 0 +2026-11-02T22:40:57.4909004Z RUNTIME read=1 (6 s) from-cache=184 not-checked=0 stated-unreadable=10 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked) +2026-11-02T22:40:57.4909908Z TAGS fetched=2 from-cache=114 retried-429=0 retried-timeout=0 (cache /root/.cache/felhom-watch-tags.json) +2026-11-02T22:40:57.4910188Z REQUESTS api.github.com=71 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 github.com=64 hub.docker.com=7 raw.githubusercontent.com=1 registry-1.docker.io=1 +2026-11-02T22:40:57.5500627Z STATE written: /tmp/state-dry.json (363 known advisories) +2026-11-02T22:40:57.6420557Z Cleaning up container for job watch +2026-11-02T22:40:58.2719670Z 🏁 Job succeeded diff --git a/documentation/audits/security-2026-11-02/part1/run-2550-runner-after.log b/documentation/audits/security-2026-11-02/part1/run-2550-runner-after.log new file mode 100644 index 00000000..f2f5a458 --- /dev/null +++ b/documentation/audits/security-2026-11-02/part1/run-2550-runner-after.log @@ -0,0 +1,286 @@ +2026-11-02T21:58:01.7044716Z felhom-gates-runner(version:v0.6.1) received task 2578 of job watch, be triggered by event: workflow_dispatch +2026-11-02T21:58:01.7088375Z workflow prepared +2026-11-02T21:58:01.7089977Z evaluating expression 'always()' +2026-11-02T21:58:01.7093551Z expression 'always()' evaluated to 'true' +2026-11-02T21:58:01.7106128Z evaluating expression '' +2026-11-02T21:58:01.7106687Z expression '' evaluated to 'true' +2026-11-02T21:58:01.7106846Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos +2026-11-02T21:58:01.7112637Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh' +2026-11-02T21:58:01.7114313Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T21:58:01.7114568Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV" +2026-11-02T21:58:01.7114727Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin +2026-11-02T21:58:01.7114979Z git init -q . && git remote add origin $base/felhom.eu.git +2026-11-02T21:58:01.7115181Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +2026-11-02T21:58:01.7115329Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)" +2026-11-02T21:58:01.7115445Z for r in felhom-controller app-catalog-felhom.eu; do +2026-11-02T21:58:01.7115557Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git +2026-11-02T21:58:01.7115681Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD +2026-11-02T21:58:01.7115848Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)" +2026-11-02T21:58:01.7115963Z done +2026-11-02T21:58:01.7116057Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T21:58:01.7116224Z ::endgroup:: +2026-11-02T21:58:14.4780322Z felhom.eu main at 4afa8c3cdee1 +2026-11-02T21:58:16.5211345Z felhom-controller at a90b62323f11 +2026-11-02T21:58:16.9565927Z app-catalog-felhom.eu at 313eaf68d01f +2026-11-02T21:58:16.9588036Z ::group::Run set -u +2026-11-02T21:58:16.9588342Z set -u +2026-11-02T21:58:16.9588581Z mkdir -p documentation/security-watch +2026-11-02T21:58:16.9589037Z mode="${MODE:-run}" +2026-11-02T21:58:16.9589216Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run +2026-11-02T21:58:16.9589471Z echo "mode: $mode" +2026-11-02T21:58:16.9589648Z case "$mode" in +2026-11-02T21:58:16.9589809Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;; +2026-11-02T21:58:16.9589982Z dry) extra="--no-mail" ; state=/tmp/state-dry.json +2026-11-02T21:58:16.9590282Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;; +2026-11-02T21:58:16.9590465Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;; +2026-11-02T21:58:16.9590657Z run) extra="" ; state=documentation/security-watch/state.json ;; +2026-11-02T21:58:16.9590901Z *) echo "unknown mode $mode"; exit 2 ;; +2026-11-02T21:58:16.9591075Z esac +2026-11-02T21:58:16.9591218Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \ +2026-11-02T21:58:16.9591476Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra +2026-11-02T21:58:16.9591694Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T21:58:16.9591903Z env: +2026-11-02T21:58:16.9592060Z RESEND_API_KEY: *** +2026-11-02T21:58:16.9592294Z GH_ADVISORY_TOKEN: *** +2026-11-02T21:58:16.9592460Z MODE: run +2026-11-02T21:58:16.9592614Z FELHOM_WHEEL_FETCH: 1 +2026-11-02T21:58:16.9592873Z ::endgroup:: +2026-11-02T21:58:16.9625503Z mode: run +2026-11-02T21:58:17.2042700Z /root/.cache/act/95d8c85aa184af73/hostexecutor/scripts/security_watch.py:1024: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). +2026-11-02T21:58:17.2043534Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date() +2026-11-02T21:58:17.2706992Z security watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight +2026-11-02T21:59:32.0851935Z ADVISORY doop actualbudget/actual-server 26.10.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0853041Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0853402Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5) +2026-11-02T21:59:32.0853845Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0) +2026-11-02T21:59:32.0854180Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0854752Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:59:32.0855062Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T21:59:32.0855342Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2) +2026-11-02T21:59:32.0855773Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more +2026-11-02T21:59:32.0856169Z ADVISORY doop getmeili/meilisearch v1.11.3 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:59:32.0856567Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4) +2026-11-02T21:59:32.0856899Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more +2026-11-02T21:59:32.0857252Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more +2026-11-02T21:59:32.0858960Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1) +2026-11-02T21:59:32.0859306Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:59:32.0859590Z ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 145 more +2026-11-02T21:59:32.0859916Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T21:59:32.0860344Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more +2026-11-02T21:59:32.0860694Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more +2026-11-02T21:59:32.0861056Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more +2026-11-02T21:59:32.0861434Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more +2026-11-02T21:59:32.0861846Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0862171Z ADVISORY box traefik v3.7.16 GHSA-xv5x-242w-7hf7 (fixed v3.7.17) +2026-11-02T21:59:32.0862833Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0863062Z ADVISORY doop vaultwarden/server 1.37.4 GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T21:59:32.0863341Z ADVISORY app actualbudget/actual-server 26.9.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0863579Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1) +2026-11-02T21:59:32.0863894Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)) +2026-11-02T21:59:32.0864150Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0864387Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1) +2026-11-02T21:59:32.0864657Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more +2026-11-02T21:59:32.0864985Z ADVISORY app getmeili/meilisearch v1.41.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:59:32.0865249Z ADVISORY app getmeili/meilisearch v1.36.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1) +2026-11-02T21:59:32.0865449Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T21:59:32.0865610Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand) +2026-11-02T21:59:32.0865772Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet) +2026-11-02T21:59:32.0865951Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6) +2026-11-02T21:59:32.0866165Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0) +2026-11-02T21:59:32.0866383Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1) +2026-11-02T21:59:32.0866606Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand) +2026-11-02T21:59:32.0866848Z ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more +2026-11-02T21:59:32.0867027Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7) +2026-11-02T21:59:32.0867179Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more +2026-11-02T21:59:32.0867382Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand) +2026-11-02T21:59:32.0867620Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more +2026-11-02T21:59:32.0867797Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1) +2026-11-02T21:59:32.0867948Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1) +2026-11-02T21:59:32.0868111Z ADVISORY app vaultwarden/server 1.37.4-alpine GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5) +2026-11-02T21:59:32.0868273Z BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11 +2026-11-02T21:59:32.0868429Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2 +2026-11-02T21:59:32.0868595Z BEHIND app freikin/dawarich 1.19.0 newest 1.20.1 +2026-11-02T21:59:32.0869023Z BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11 +2026-11-02T21:59:32.0869234Z BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01 +2026-11-02T21:59:32.0869414Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4 +2026-11-02T21:59:32.0869579Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0 +2026-11-02T21:59:32.0869716Z BEHIND app gotson/komga 1.28.0 newest 1.29.2 +2026-11-02T21:59:32.0869859Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0 +2026-11-02T21:59:32.0870019Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0 +2026-11-02T21:59:32.0870204Z BEHIND app lukevella/rallly 4.16.3 newest 4.16.4 +2026-11-02T21:59:32.0870337Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache +2026-11-02T21:59:32.0870537Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine +2026-11-02T21:59:32.0870739Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2 +2026-11-02T21:59:32.0870928Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T21:59:32.0871059Z GAP buil alpine 3.24.2 newest 3.24.3 +2026-11-02T21:59:32.0871228Z GAP doop alpine/k8s 1.37.1 newest 1.37.2 +2026-11-02T21:59:32.0871419Z GAP doop arcadiatechnology/crafty-4 4.11.0 +2026-11-02T21:59:32.0871548Z GAP doop bhgedigital/envsubst latest +2026-11-02T21:59:32.0871709Z GAP doop busybox 1.38 +2026-11-02T21:59:32.0871863Z GAP doop codercom/code-server 4.143.1 newest 4.144.0 +2026-11-02T21:59:32.0871997Z GAP buil debian 13.7-slim +2026-11-02T21:59:32.0872123Z GAP buil debian 13.7-slim +2026-11-02T21:59:32.0872270Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3 +2026-11-02T21:59:32.0872474Z GAP doop docker.io/library/nextcloud 34.0.5-apache +2026-11-02T21:59:32.0872722Z GAP doop docker.io/valkey/valkey 9.2-alpine +2026-11-02T21:59:32.0872883Z GAP doop filebrowser/filebrowser v2.63.23 +2026-11-02T21:59:32.0873054Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11 +2026-11-02T21:59:32.0873227Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0 +2026-11-02T21:59:32.0873362Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0 +2026-11-02T21:59:32.0873562Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0 +2026-11-02T21:59:32.0873733Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0 +2026-11-02T21:59:32.0873860Z GAP doop ghcr.io/seriousm4x/upsnap 5 +2026-11-02T21:59:32.0874029Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23 +2026-11-02T21:59:32.0874257Z GAP doop ghcr.io/tautulli/tautulli v2.18.2 +2026-11-02T21:59:32.0874386Z GAP doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 +2026-11-02T21:59:32.0874515Z GAP doop gitea.dooplex.hu/admin/jarr latest +2026-11-02T21:59:32.0874641Z GAP doop gitea.dooplex.hu/admin/recipe-importer latest +2026-11-02T21:59:32.0874844Z GAP doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 +2026-11-02T21:59:32.0874969Z GAP doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 +2026-11-02T21:59:32.0875103Z GAP doop gitea.dooplex.hu/admin/wan-probe 0.1.0 +2026-11-02T21:59:32.0875258Z GAP doop griefed/serverpackcreator 8.1.2 +2026-11-02T21:59:32.0875386Z GAP doop gtstef/filebrowser 1.5.8-stable +2026-11-02T21:59:32.0875605Z GAP doop guacamole/guacamole 1.6.0 +2026-11-02T21:59:32.0875821Z GAP doop guacamole/guacd 1.6.0 +2026-11-02T21:59:32.0875980Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T21:59:32.0876109Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3 +2026-11-02T21:59:32.0876240Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17 +2026-11-02T21:59:32.0876434Z GAP doop linuxserver/bookstack 26.09.20260929 +2026-11-02T21:59:32.0876571Z GAP doop linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T21:59:32.0876768Z GAP doop linuxserver/qbittorrent 5.3.0 +2026-11-02T21:59:32.0876889Z GAP doop linuxserver/radarr version-6.4.4.10685 +2026-11-02T21:59:32.0877056Z GAP doop linuxserver/sonarr version-4.0.20.3014 +2026-11-02T21:59:32.0877181Z GAP doop mariadb 11 +2026-11-02T21:59:32.0877301Z GAP doop mikefarah/yq 4.54.1 +2026-11-02T21:59:32.0877450Z GAP doop minio/minio latest +2026-11-02T21:59:32.0877572Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204 +2026-11-02T21:59:32.0877709Z GAP doop msdeluise/plant-it-server 0.10.0 +2026-11-02T21:59:32.0877896Z GAP doop mysql 8.4 +2026-11-02T21:59:32.0878116Z GAP doop nicolaka/netshoot latest +2026-11-02T21:59:32.0878245Z GAP doop postgis/postgis 16-3.5 +2026-11-02T21:59:32.0878365Z GAP doop postgres 15-alpine +2026-11-02T21:59:32.0878511Z GAP doop postgres 16-alpine +2026-11-02T21:59:32.0878637Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0 +2026-11-02T21:59:32.0878842Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2 +2026-11-02T21:59:32.0878991Z GAP doop prom/node-exporter v1.12.1 +2026-11-02T21:59:32.0879154Z GAP doop prom/prometheus v3.15.0 newest v3.15.1 +2026-11-02T21:59:32.0879282Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0 +2026-11-02T21:59:32.0879411Z GAP doop python 3.15-bookworm +2026-11-02T21:59:32.0879563Z GAP doop quay.io/jetstack/version-checker v0.11.0 +2026-11-02T21:59:32.0879687Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1 +2026-11-02T21:59:32.0879820Z GAP doop renovate/renovate 44.181.1 newest 44.206.0 +2026-11-02T21:59:32.0880054Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4 +2026-11-02T21:59:32.0880330Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13 +2026-11-02T21:59:32.0880464Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg +2026-11-02T21:59:32.0880590Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1 +2026-11-02T21:59:32.0880823Z GAP app mariadb 12.3 +2026-11-02T21:59:32.0880944Z GAP app mariadb 11.4 newest 11.8 +2026-11-02T21:59:32.0881067Z GAP app mariadb 11.8 +2026-11-02T21:59:32.0881194Z GAP app mariadb 12.3 +2026-11-02T21:59:32.0881352Z GAP app mariadb 11.8 +2026-11-02T21:59:32.0881475Z GAP app msdeluise/plant-it 0.10.0 +2026-11-02T21:59:32.0881597Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0 +2026-11-02T21:59:32.0881745Z GAP app postgis/postgis 16-3.5-alpine +2026-11-02T21:59:32.0881868Z GAP app postgis/postgis 17-3.5-alpine +2026-11-02T21:59:32.0881987Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0882114Z GAP app postgres 17-alpine +2026-11-02T21:59:32.0882274Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0882462Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0882813Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0882959Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0883082Z GAP app postgres 18-alpine +2026-11-02T21:59:32.0883207Z GAP app postgres 17-alpine +2026-11-02T21:59:32.0883329Z GAP app postgres 16-alpine +2026-11-02T21:59:32.0883488Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0 +2026-11-02T21:59:32.0883619Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest +2026-11-02T21:59:32.0883764Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest +2026-11-02T21:59:32.0883965Z FLOATING doop nginx 1.31-alpine +2026-11-02T21:59:32.0884187Z FLOATING doop redis 8-alpine +2026-11-02T21:59:32.0884401Z FLOATING doop redis 8.10-alpine +2026-11-02T21:59:32.0884592Z FLOATING app ghcr.io/claperco/claper 2.5 +2026-11-02T21:59:32.0884979Z FLOATING app ghcr.io/thomiceli/opengist 1.15 +2026-11-02T21:59:32.0885120Z FLOATING app jellyfin/jellyfin 12.4 +2026-11-02T21:59:32.0885283Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623 +2026-11-02T21:59:32.0885438Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3 +2026-11-02T21:59:32.0885568Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0 +2026-11-02T21:59:32.0885690Z FLOATING app nzbgetcom/nzbget v26.3 +2026-11-02T21:59:32.0885810Z FLOATING app redis 7.4-alpine +2026-11-02T21:59:32.0886037Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0886258Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0886375Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0886642Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0886766Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0886947Z FLOATING app redis 7-alpine +2026-11-02T21:59:32.0887066Z FLOATING app wger/server 2.7 +2026-11-02T21:59:32.0887231Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0 +2026-11-02T21:59:32.0887362Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11 +2026-11-02T21:59:32.0887489Z CURRENT doop f0rc3/gokapi v2.2.4 +2026-11-02T21:59:32.0887647Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T21:59:32.0887776Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3 +2026-11-02T21:59:32.0887897Z CURRENT doop glanceapp/glance v0.8.7 +2026-11-02T21:59:32.0888015Z CURRENT buil golang 1.27.3-trixie +2026-11-02T21:59:32.0888178Z CURRENT buil golang 1.27.3-alpine3.24 +2026-11-02T21:59:32.0888293Z CURRENT doop onlyoffice/documentserver 9.4.0 +2026-11-02T21:59:32.0888422Z CURRENT buil restic 0.19.1 +2026-11-02T21:59:32.0888673Z CURRENT app deluan/navidrome 0.64.2 +2026-11-02T21:59:32.0888867Z CURRENT app docmost/docmost 0.97.0 +2026-11-02T21:59:32.0888988Z CURRENT app flomp/wanderer-db v0.21.2 +2026-11-02T21:59:32.0889107Z CURRENT app flomp/wanderer-web v0.21.2 +2026-11-02T21:59:32.0889271Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2 +2026-11-02T21:59:32.0889391Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0 +2026-11-02T21:59:32.0889512Z CURRENT app ghcr.io/diced/zipline 4.8.2 +2026-11-02T21:59:32.0889655Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0 +2026-11-02T21:59:32.0889776Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0 +2026-11-02T21:59:32.0889905Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0 +2026-11-02T21:59:32.0890193Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4 +2026-11-02T21:59:32.0890457Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless +2026-11-02T21:59:32.0890663Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1 +2026-11-02T21:59:32.0890788Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1 +2026-11-02T21:59:32.0890940Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1 +2026-11-02T21:59:32.0891069Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1 +2026-11-02T21:59:32.0891190Z CURRENT app ghost 6.73.0-alpine +2026-11-02T21:59:32.0891308Z CURRENT app lscr.io/linuxserver/bookstack 26.09.2 +2026-11-02T21:59:32.0891479Z CURRENT app lscr.io/linuxserver/grocy 4.7.1 +2026-11-02T21:59:32.0891622Z CURRENT app lscr.io/linuxserver/radarr 6.4.4 +2026-11-02T21:59:32.0891754Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20 +2026-11-02T21:59:32.0891883Z CURRENT app onlyoffice/documentserver 9.4.0 +2026-11-02T21:59:32.0892011Z CURRENT app outlinewiki/outline 1.12.0 +2026-11-02T21:59:32.0892151Z CURRENT app vikunja/vikunja 2.7.1 +2026-11-02T21:59:32.0892294Z COUNTS ADVISORY=48 BEHIND=14 CURRENT=32 FLOATING=20 GAP=81 SELF=2 +2026-11-02T21:59:32.0892432Z FAILED-SOURCES 0 +2026-11-02T21:59:32.0892546Z RUNTIME read=0 (0 s) from-cache=185 not-checked=0 stated-unreadable=10 zstd-decoder=not needed +2026-11-02T21:59:32.0892687Z TAGS fetched=0 from-cache=116 retried-429=0 retried-timeout=1 (cache /root/.cache/felhom-watch-tags.json) +2026-11-02T21:59:32.0892848Z REQUESTS api.github.com=70 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 github.com=64 hub.docker.com=1 raw.githubusercontent.com=1 registry-1.docker.io=1 +2026-11-02T21:59:32.3999417Z MAIL RESEND-ACCEPTED id=01a19e46-56c1-79dd-b30a-c9d356e5c911 kind=advisory subject=[Felhom security] traefik, actual-server, meilisearch, uptime-kuma … — 13 new advisories +2026-11-02T21:59:32.4122228Z STATE written: documentation/security-watch/state.json (364 known advisories) +2026-11-02T21:59:32.5450553Z ::group::Run set -u +2026-11-02T21:59:32.5450888Z set -u +2026-11-02T21:59:32.5451017Z f=documentation/security-watch/state.json +2026-11-02T21:59:32.5451135Z if [ ! -f "$f" ]; then +2026-11-02T21:59:32.5451274Z echo "no memory file was written - nothing to commit"; exit 0 +2026-11-02T21:59:32.5451450Z fi +2026-11-02T21:59:32.5451620Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then +2026-11-02T21:59:32.5451792Z echo "memory unchanged - nothing to commit"; exit 0 +2026-11-02T21:59:32.5451907Z fi +2026-11-02T21:59:32.5452012Z cp "$f" /tmp/state.json +2026-11-02T21:59:32.5452117Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())') +2026-11-02T21:59:32.5452327Z for attempt in 1 2 3; do +2026-11-02T21:59:32.5452476Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD +2026-11-02T21:59:32.5452596Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f" +2026-11-02T21:59:32.5452717Z git add "$f" +2026-11-02T21:59:32.5452820Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \ +2026-11-02T21:59:32.5452944Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; } +2026-11-02T21:59:32.5453150Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then +2026-11-02T21:59:32.5453342Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0 +2026-11-02T21:59:32.5453468Z fi +2026-11-02T21:59:32.5453576Z echo "push refused (attempt $attempt) - re-fetching main" +2026-11-02T21:59:32.5453694Z sleep 5 +2026-11-02T21:59:32.5453816Z done +2026-11-02T21:59:32.5454006Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1 +2026-11-02T21:59:32.5454131Z shell: bash --noprofile --norc -e -o pipefail {0} +2026-11-02T21:59:32.5454283Z env: +2026-11-02T21:59:32.5454384Z PUSH_TOKEN: *** +2026-11-02T21:59:32.5454495Z ::endgroup:: +2026-11-02T21:59:33.7201862Z memory pushed: a560e6995467 +2026-11-02T21:59:33.7218513Z Cleaning up container for job watch +2026-11-02T21:59:34.3001755Z 🏁 Job succeeded diff --git a/documentation/audits/security-2026-11-02/part4/hub-slow-lines-2026-11-01-02.txt b/documentation/audits/security-2026-11-02/part4/hub-slow-lines-2026-11-01-02.txt new file mode 100644 index 00000000..6a722ecc --- /dev/null +++ b/documentation/audits/security-2026-11-02/part4/hub-slow-lines-2026-11-01-02.txt @@ -0,0 +1,35 @@ +2026/11/01 16:15:23 [WARN] slow statement: 2363ms (over 1s): SELECT id, layer, fingerprint, approved_at, approved_by, packages_json, test, cancelled_at, cancel_reason FROM os_releases r WHERE r.layer = ? AND r.test = 1 AND r.cancelled_at = '' AND r.approved_at >= COALESCE((SELECT MAX(approved_at) FROM os_releases WHERE layer = r.layer AND test = 0 AND cancell… +2026/11/01 16:15:25 [WARN] slow statement: 1317ms (over 1s): DELETE FROM host_reports WHERE received_at < ? +2026/11/01 16:15:35 [WARN] slow statement: 10436ms (over 1s): DELETE FROM events WHERE created_at < ? +2026/11/01 16:15:36 [WARN] slow statement: 1045ms (over 1s): DELETE FROM app_telemetry WHERE reported_at < ? +2026/11/01 16:15:58 [WARN] slow statement: 21154ms (over 1s): DELETE FROM app_log_issues WHERE last_seen < ? +2026/11/01 16:16:10 [WARN] slow statement: 12811ms (over 1s): SELECT r.customer_id, r.received_at, r.report_json, r.health_status, r.cpu_percent, r.memory_percent, r.container_total, r.container_running, r.backup_last_snapshot, r.controller_version, r.controller_url FROM reports r INNER JOIN ( SELECT customer_id, MAX(id) as max_id FROM reports GROUP BY custome… +2026/11/01 16:16:25 [WARN] slow statement: 1914ms (over 1s): SELECT host_id, customer_id, api_key, agent_version, last_report_at, desired_json, desired_generation, recovery_mode_until, created_at, updated_at, deliberate_off_at FROM hosts ORDER BY host_id +2026/11/01 16:16:25 [WARN] slow statement: 1685ms (over 1s): SELECT id, customer_id, path, requested_at, due_at, cancelled_at, cancelled_by, deleted_at, last_error FROM offsite_abandon_requests WHERE cancelled_at IS NULL AND deleted_at IS NULL AND due_at <= datetime('now') +2026/11/01 16:16:27 [WARN] slow statement: 1610ms (over 1s): SELECT id, host_id, layer, received_at, trigger, mode, outcome, healthy, release_id, report_json FROM os_reports WHERE host_id = ? AND layer = ? ORDER BY id DESC LIMIT 1 +2026/11/01 16:16:28 [WARN] slow statement: 1180ms (over 1s): SELECT id, host_id, layer, received_at, trigger, mode, outcome, healthy, release_id, report_json FROM os_reports WHERE host_id = ? AND layer = ? ORDER BY id DESC LIMIT 1 +2026/11/01 16:16:33 [WARN] slow statement: 22029ms (over 1s): SELECT hr.host_id, hr.customer_id, hr.report_json FROM host_reports hr JOIN (SELECT host_id, MAX(id) AS mx FROM host_reports GROUP BY host_id) latest ON hr.id = latest.mx +2026/11/01 16:16:42 [WARN] slow statement: 13636ms (over 1s): SELECT id, host_id, layer, received_at, trigger, mode, outcome, healthy, release_id, report_json FROM os_reports WHERE host_id = ? AND layer = ? AND received_at >= ? ORDER BY id +2026/11/01 16:16:53 [WARN] slow statement: 10984ms (over 1s): SELECT id, host_id, layer, received_at, trigger, mode, outcome, healthy, release_id, report_json FROM os_reports WHERE host_id = ? AND layer = ? AND received_at >= ? ORDER BY id +2026/11/01 16:17:03 [WARN] slow statement: 9059ms (over 1s): SELECT id, host_id, layer, received_at, trigger, mode, outcome, healthy, release_id, report_json FROM os_reports WHERE host_id = ? AND layer = ? ORDER BY id DESC LIMIT ? +2026/11/01 16:17:59 [WARN] slow statement: 26606ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/01 16:18:18 [WARN] slow statement: 18204ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/01 16:18:32 [WARN] slow statement: 13023ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/01 16:30:24 [WARN] slow statement: 1028ms (over 1s): SELECT id, report_json FROM reports WHERE customer_id = ? ORDER BY id DESC LIMIT 1 +2026/11/01 20:01:36 [WARN] slow statement: 96729ms (over 1s): VACUUM INTO ? +2026/11/01 23:20:24 [WARN] slow statement: 1212ms (over 1s): SELECT id, report_json FROM reports WHERE customer_id = ? ORDER BY id DESC LIMIT 1 +2026/11/02 02:01:37 [WARN] slow statement: 4062ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 02:01:39 [WARN] slow statement: 1067ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 02:01:43 [WARN] slow statement: 3316ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 02:02:03 [WARN] slow statement: 123110ms (over 1s): VACUUM INTO ? +2026/11/02 02:38:37 [WARN] slow statement: 1015ms (over 1s): SELECT received_at, report_json FROM reports WHERE customer_id = ? ORDER BY id DESC LIMIT 1 +2026/11/02 04:30:06 [WARN] slow statement: 4381ms (over 1s): DELETE FROM app_log_issues WHERE last_seen < ? +2026/11/02 07:10:04 [WARN] slow statement: 2110ms (over 1s): SELECT report_json FROM reports WHERE customer_id = ? AND received_at > ? ORDER BY id LIMIT 5000 +2026/11/02 07:10:06 [WARN] slow statement: 1078ms (over 1s): SELECT report_json FROM reports WHERE customer_id = ? AND received_at > ? ORDER BY id LIMIT 5000 +2026/11/02 07:25:24 [WARN] slow statement: 1103ms (over 1s): SELECT id, report_json FROM reports WHERE customer_id = ? ORDER BY id DESC LIMIT 1 +2026/11/02 08:01:35 [WARN] slow statement: 1975ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 08:01:37 [WARN] slow statement: 1110ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 08:01:51 [WARN] slow statement: 111549ms (over 1s): VACUUM INTO ? +2026/11/02 14:01:34 [WARN] slow statement: 1562ms (over 1s): SELECT received_at, report_json FROM host_reports WHERE customer_id = ? AND received_at >= ? ORDER BY received_at DESC +2026/11/02 14:01:50 [WARN] slow statement: 110377ms (over 1s): VACUUM INTO ? +2026/11/02 20:01:50 [WARN] slow statement: 110209ms (over 1s): VACUUM INTO ? diff --git a/documentation/audits/security-2026-11-02/part4/restore-test-demo-hp.txt b/documentation/audits/security-2026-11-02/part4/restore-test-demo-hp.txt new file mode 100644 index 00000000..e492c4bf --- /dev/null +++ b/documentation/audits/security-2026-11-02/part4/restore-test-demo-hp.txt @@ -0,0 +1,3 @@ +Oct 24 10:11:38 demo-hp felhom-agent[3363151]: time=2026-10-24T10:11:38.422+02:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-pbs:backup/ct/9201/2026-10-22T20:43:51 +Oct 30 10:44:48 demo-hp felhom-agent[1819483]: time=2026-10-30T10:44:48.948+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_29-04_52 +Oct 30 22:55:30 demo-hp felhom-agent[1819483]: time=2026-10-30T22:55:30.590+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-pbs:backup/ct/9201/2026-10-29T20:47:29 diff --git a/documentation/audits/security-2026-11-02/part4/restore-test-n100.txt b/documentation/audits/security-2026-11-02/part4/restore-test-n100.txt new file mode 100644 index 00000000..67286dc8 --- /dev/null +++ b/documentation/audits/security-2026-11-02/part4/restore-test-n100.txt @@ -0,0 +1,11 @@ +Oct 24 09:25:40 demo-felhom felhom-agent[3421116]: time=2026-10-24T09:25:40.297+02:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Oct 25 09:10:19 demo-felhom felhom-agent[885823]: time=2026-10-25T09:10:19.045+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026_ +Oct 26 05:40:32 demo-felhom felhom-agent[3047590]: time=2026-10-26T05:40:32.984+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Oct 27 09:41:06 demo-felhom felhom-agent[4120470]: time=2026-10-27T09:41:06.598+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Oct 28 04:56:19 demo-felhom felhom-agent[1634408]: time=2026-10-28T04:56:19.976+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Oct 28 10:56:55 demo-felhom felhom-agent[1634408]: time=2026-10-28T10:56:55.494+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-pbs:backup/ct/9201/2026-10-27T04:3 +Oct 29 05:19:25 demo-felhom felhom-agent[1194]: time=2026-10-29T05:19:25.598+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026_10 +Oct 30 05:35:13 demo-felhom felhom-agent[832543]: time=2026-10-30T05:35:13.441+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026_ +Oct 31 04:50:01 demo-felhom felhom-agent[2017068]: time=2026-10-31T04:50:01.164+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Nov 01 10:50:01 demo-felhom felhom-agent[2017068]: time=2026-11-01T10:50:01.206+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 +Nov 02 10:50:01 demo-felhom felhom-agent[2017068]: time=2026-11-02T10:50:01.134+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-backup:backup/vzdump-lxc-9201-2026 diff --git a/documentation/audits/security-2026-11-02/part4/restore-test-tester1.txt b/documentation/audits/security-2026-11-02/part4/restore-test-tester1.txt new file mode 100644 index 00000000..236c6a7a --- /dev/null +++ b/documentation/audits/security-2026-11-02/part4/restore-test-tester1.txt @@ -0,0 +1,12 @@ +Oct 24 06:03:53 felhom felhom-agent[1166]: time=2026-10-24T06:03:53.151+02:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_23-05_03_02. +Oct 25 07:17:25 felhom felhom-agent[1146]: time=2026-10-25T07:17:25.115+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_24-05_04_52. +Oct 26 05:47:34 felhom felhom-agent[1789280]: time=2026-10-26T05:47:34.941+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_25-04_31_ +Oct 26 21:48:57 felhom felhom-agent[3100317]: time=2026-10-26T21:48:57.142+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-pbs:backup/ct/9201/2026-10-25T20:07:13Z +Oct 27 09:47:35 felhom felhom-agent[3100317]: time=2026-10-27T09:47:35.924+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_26-04_32_ +Oct 28 05:03:01 felhom felhom-agent[961489]: time=2026-10-28T05:03:01.155+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_27-04_35_3 +Oct 29 05:42:30 felhom felhom-agent[1161]: time=2026-10-29T05:42:30.438+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_28-04_36_50. +Oct 30 05:44:00 felhom felhom-agent[1103818]: time=2026-10-30T05:44:00.926+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_29-04_41_ +Oct 31 04:43:25 felhom felhom-agent[2609044]: time=2026-10-31T04:43:25.155+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_30-04_42_ +Nov 01 10:43:45 felhom felhom-agent[2609044]: time=2026-11-01T10:43:45.248+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_10_31-04_46_ +Nov 02 10:43:35 felhom felhom-agent[2609044]: time=2026-11-02T10:43:35.227+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=local:backup/vzdump-lxc-9201-2026_11_01-04_51_ +Nov 02 22:45:32 felhom felhom-agent[2609044]: time=2026-11-02T22:45:32.547+01:00 level=INFO msg="backup: scheduled restore-test passed" archive=felhom-pbs:backup/ct/9201/2026-11-01T20:11:41Z diff --git a/documentation/audits/security-2026-11-02/part4/romm-demo-hp-app-yaml.txt b/documentation/audits/security-2026-11-02/part4/romm-demo-hp-app-yaml.txt new file mode 100644 index 00000000..85f06154 --- /dev/null +++ b/documentation/audits/security-2026-11-02/part4/romm-demo-hp-app-yaml.txt @@ -0,0 +1,69 @@ +# Auto-generated by felhom-controller — do not edit locked fields manually +deployed: true +deployed_at: "2026-10-16T14:58:17Z" +env: + DOMAIN: enkisfelhom.hu + HDD_PATH: /mnt/felhom-drives/hdd_1 + SUBDOMAIN: arcade +locked_fields: + - DOMAIN + - SUBDOMAIN + - HDD_PATH +desired_state: running +installed_images: + romm: + ref: rommapp/romm:5.4.1 + digest: sha256:8677fb7b81b1d3db20b849e989a1dadc2a11159e51eb34a2acdcb01102274edf + at: "2026-10-28T03:23:37Z" + romm-db: + ref: mariadb:11.8 + digest: sha256:c4124d1afa875e47f2892edf26b482fa54f796e2f342d3717a04ca091a22a9bd + at: "2026-10-28T03:23:37Z" + romm-redis: + ref: redis:7-alpine + digest: sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af + at: "2026-10-28T03:23:37Z" +pinned_images: + romm: rommapp/romm:5.4.1 + romm-db: mariadb:11.8 + romm-redis: redis:7-alpine +last_auto_update: + at: "2026-10-28T03:22:09Z" + outcome: done + from: + romm: rommapp/romm:5.3.1 + romm-db: mariadb:11.8 + romm-redis: redis:7-alpine + to: + romm: rommapp/romm:5.4.1 + romm-db: mariadb:11.8 + romm-redis: redis:7-alpine +setup_gate: + state: closed + since: "2026-10-16T14:58:17Z" + hosts: + - arcade.enkisfelhom.hu +previous_images: + romm: + ref: rommapp/romm:5.3.1 + digest: sha256:0d66b4ea152a237c7f24b95e87459f46d3c596a7c0b35a82f26bc971487278b3 + at: "2026-10-16T14:58:57Z" + romm-db: + ref: mariadb:11.8 + digest: sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68 + at: "2026-10-16T14:58:57Z" + romm-redis: + ref: redis:7-alpine + digest: sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499 + at: "2026-10-16T14:58:57Z" +install_id: e4637a49405a2049 +{ + "status": "success", + "previous_version": "0.348.0", + "previous_image": "gitea.dooplex.hu/admin/felhom-controller:0.348.0", + "target_version": "0.349.0", + "target_image": "gitea.dooplex.hu/admin/felhom-controller:0.349.0", + "initiated_at": "2026-10-29T18:21:23Z", + "initiated_by": "auto-floor", + "completed_at": "2026-10-29T18:21:31Z" +} diff --git a/documentation/audits/security-2026-11-02/waiters.txt b/documentation/audits/security-2026-11-02/waiters.txt new file mode 100644 index 00000000..74436dd9 --- /dev/null +++ b/documentation/audits/security-2026-11-02/waiters.txt @@ -0,0 +1,26 @@ +== ActualBudget (R-1336) pin 26.9.0; tags read 300; newest same shape ['26.10.0', '26.11.0'] + actualbudget/actual-server:26.9.0 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:59cab86c77e764855119e2d5ddd96b9c9cefd90913f4feed7f4ee1433a6482c5", "env": {}, "node": "24.20.0", "python": null, "apk": {}, "dpkg": {}, "brotli": null, "brotlicffi": null} + actualbudget/actual-server:26.10.0 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:bdfbb624d5fe9df05481d8eb6791a00a4a78ab8152bce31e79c6f18917e6933e", "env": {}, "node": "24.21.0", "python": null, "apk": {}, "dpkg": {}, "brotli": null, "brotlicffi": null} + actualbudget/actual-server:26.11.0 verdict=clean read={"unchecked": [], "digest": "sha256:c56adb686c5b72d755a4958905a27212edc6be27d065ebe3cb470c95c552df89", "env": {}, "node": "24.22.1", "python": null, "apk": {}, "dpkg": {}, "brotli": null, "brotlicffi": null} +== cal.com (R-1329/R-1325) pin v6.2.0; tags read 300; newest same shape ['v6.1.15', 'v6.1.16', 'v6.2.0'] + calcom/cal.com:v6.1.15 verdict=BAD CVE-2026-111497 fixed 22.23.4, 24.22.1, 26.12.1 read={"unchecked": ["byte budget reached before layer sha256:89edcaae7ec4 (22 MB)"], "digest": "sha256:90e0ec86153318f7c3aeab28efe09ea050c12c5eec2d4e82a447bf1620f0a5bf", "env": {}, "node": "20.20.0", "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.0.9-2+b6"}, "brotli": null, "brotlicffi": null} + calcom/cal.com:v6.1.16 verdict=BAD CVE-2026-111497 fixed 22.23.4, 24.22.1, 26.12.1 read={"unchecked": ["byte budget reached before layer sha256:89edcaae7ec4 (22 MB)"], "digest": "sha256:0816179076b79361badb93a12a3daff47f46d2ab786f4c5492d1be789af7ea92", "env": {}, "node": "20.20.0", "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.0.9-2+b6"}, "brotli": null, "brotlicffi": null} + calcom/cal.com:v6.2.0 verdict=BAD CVE-2026-111497 fixed 22.23.4, 24.22.1, 26.12.1 read={"unchecked": ["byte budget reached before layer sha256:aab3b37e4807 (22 MB)"], "digest": "sha256:9d962292d21244382560a129fc0a5519b83fff9fd2ad77baa72947db2b3c5001", "env": {}, "node": "20.20.0", "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.0.9-2+b6"}, "brotli": null, "brotlicffi": null} +== Calibre-Web (R-1337) pin v4.0.8; tags read 108; newest same shape ['v4.0.6', 'v4.0.7', 'v4.0.8'] + crocodilestick/calibre-web-automated:v4.0.6 verdict=BAD CVE-2026-111497 fixed 1.2.1 read={"unchecked": [], "digest": "sha256:fbf0c866e77b366f07050a6a12fee4e840b60d364485576a810109851a488eec", "env": {}, "node": null, "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2build2"}, "brotli": "1.2.0", "brotlicffi": null} + crocodilestick/calibre-web-automated:v4.0.7 verdict=BAD CVE-2026-111497 fixed 1.2.1 read={"unchecked": [], "digest": "sha256:1e7d70dffe25fa7a4b1f02d27e6ccee92a4569e225f68d22861d4435927f8b6b", "env": {}, "node": null, "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2build2"}, "brotli": "1.2.0", "brotlicffi": null} + crocodilestick/calibre-web-automated:v4.0.8 verdict=BAD CVE-2026-111497 fixed 1.2.1 read={"unchecked": [], "digest": "sha256:1297be5207318acea7030884a2d283ef3e805c745eaeaa4c5602bc3dc9b7f47a", "env": {}, "node": null, "python": null, "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2build2"}, "brotli": "1.2.0", "brotlicffi": null} +== Paperless (R-1331) pin 2.20.15; tags read 279; newest same shape ['3.3.4', '3.4.0', '3.4.1'] + ghcr.io/paperless-ngx/paperless-ngx:2.20.15 verdict=BAD CVE-2026-111497 fixed 1.1.1 read={"unchecked": [], "digest": "sha256:835974fc3368fc6714aa38542db7a1f0f542d03244e39b981e519aefc100f355", "env": {}, "node": null, "python": "3.12.12", "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2+b7"}, "brotli": "1.1.0", "brotlicffi": null} + ghcr.io/paperless-ngx/paperless-ngx:3.3.4 verdict=BAD CVE-2026-111497 fixed 1.2.1 read={"unchecked": [], "digest": "sha256:b3f480cc5a8beb3ad45cb484b7c606f93240ae58fbfaf4f609be1cfa248267e8", "env": {}, "node": null, "python": "3.14.9", "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2+b7"}, "brotli": "1.2.0", "brotlicffi": null} + ghcr.io/paperless-ngx/paperless-ngx:3.4.0 verdict=clean read={"unchecked": [], "digest": "sha256:39fd4fac06dc928b0bea22bc85abcd724f0f6a83ab33653aa17fc31d3cc522ce", "env": {}, "node": null, "python": "3.14.9", "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2+b7"}, "brotli": "1.2.1", "brotlicffi": null} + ghcr.io/paperless-ngx/paperless-ngx:3.4.1 verdict=clean read={"unchecked": [], "digest": "sha256:fd6d363d8fd783781775663f4acf9195bc000dfb9f569fddd9cbdd8d656e5605", "env": {}, "node": null, "python": "3.14.9", "apk": {}, "dpkg": {"libbrotli1": "1.1.0-2+deb13u1"}, "brotli": "1.2.1", "brotlicffi": null} +== RomM (R-1330) pin 5.4.1; tags read 300; newest same shape ['5.3.1', '5.4.0', '5.4.1'] + rommapp/romm:5.3.1 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:11705517fd018590daeb71d21b0c255335206ec3c2984caa7adc3468ca34a862", "env": {}, "node": "24.18.1", "python": null, "apk": {"brotli-libs": "1.2.0-r1", "nodejs": "24.18.1-r0"}, "dpkg": {}, "brotli": null, "brotlicffi": null} + rommapp/romm:5.4.0 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:d5cd2424802f2649dbd6526c07a8de335b9687a4c032b46256c96c82217067f6", "env": {}, "node": "24.18.1", "python": null, "apk": {"brotli-libs": "1.2.0-r1", "nodejs": "24.18.1-r0"}, "dpkg": {}, "brotli": null, "brotlicffi": null} + rommapp/romm:5.4.1 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:923a808be529a834a171b3e045821aeb7e2851f4b6fc9514076785b68a9142f6", "env": {}, "node": "24.18.1", "python": null, "apk": {"brotli-libs": "1.2.1-r0", "nodejs": "24.18.1-r0"}, "dpkg": {}, "brotli": null, "brotlicffi": null} +== SparkyFitness pin v0.17.3; tags read 113; newest same shape ['v1.9.0', 'v1.10.0', 'v1.11.0'] + codewithcj/sparkyfitness_server:v0.17.3 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:d16c593650c975b9c6c044363fd7bfe95b6cee311fb8af2bc49079a42072e333", "env": {}, "node": "24.18.0", "python": null, "apk": {"brotli-libs": "1.2.0-r1"}, "dpkg": {}, "brotli": null, "brotlicffi": null} + codewithcj/sparkyfitness_server:v1.9.0 verdict=BAD CVE-2026-111497 fixed 24.22.1 read={"unchecked": [], "digest": "sha256:8e652a04a2b631f5ac5f7dd04c5c156dc9377a4dbe7f8bf55bd52da05184ca3e", "env": {}, "node": "24.22.0", "python": null, "apk": {"brotli-libs": "1.2.0-r1"}, "dpkg": {}, "brotli": null, "brotlicffi": null} + codewithcj/sparkyfitness_server:v1.10.0 verdict=clean read={"unchecked": [], "digest": "sha256:5ec3a37334acbddc85b9312f60d5f2cc630306099a105b1882e46a644944a952", "env": {}, "node": "24.22.1", "python": null, "apk": {"brotli-libs": "1.2.1-r0"}, "dpkg": {}, "brotli": null, "brotlicffi": null} + codewithcj/sparkyfitness_server:v1.11.0 verdict=clean read={"unchecked": [], "digest": "sha256:453a64787dc75f72e86c271748e37813985d85d53e194f53710a98ca667fa5b4", "env": {}, "node": "24.22.1", "python": null, "apk": {"brotli-libs": "1.2.1-r0"}, "dpkg": {}, "brotli": null, "brotlicffi": null} diff --git a/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/box-verdict-n8n.json b/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/box-verdict-n8n.json new file mode 100644 index 00000000..f0a4acd2 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/box-verdict-n8n.json @@ -0,0 +1,48 @@ +{ + "app": "n8n", + "walk": "security", + "box_walk_version": 1, + "verdict": "inconclusive", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "n8n": "n8nio/n8n:2.44.7" + }, + "to": { + "n8n": "n8nio/n8n:2.46.4" + }, + "observables_before": { + "pinned_images": { + "n8n": "n8nio/n8n:2.44.7" + }, + "installed_images": { + "n8n": "n8nio/n8n:2.44.7" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: n8nio/n8n:2.44.7@sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b" + ], + "docker_inspect": [ + "n8n n8nio/n8n:2.44.7@sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "why": "C1: the fixture could not seed and read back before the update", + "log": [ + "23:22:42 [5] the box's drill mirror now at 3cabefca", + "23:22:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:24:52 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.44.7'}", + "23:24:52 gate: auto is gated — passed as the household (cookie set)", + "23:24:56 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "23:24:56 n8n: /rest/owner/setup http=404", + "23:24:56 n8n: refused \n\n\n\nError\n\n\n
Cannot POST /rest/owner/setup
\n\n\n" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/walk.txt b/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/walk.txt new file mode 100644 index 00000000..021b6550 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_n8n-try1-fixture-race/walk.txt @@ -0,0 +1,22 @@ +23:22:42 [5] the box's drill mirror now at 3cabefca +23:22:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:24:52 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.44.7'} +23:24:52 gate: auto is gated — passed as the household (cookie set) +23:24:56 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +23:24:56 n8n: /rest/owner/setup http=404 +23:24:56 n8n: refused + + + +Error + + +
Cannot POST /rest/owner/setup
+ + + +23:24:56 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/n8n/verdict.json +23:24:56 RESULT inconclusive — C1: the fixture could not seed and read back before the update +23:24:58 [X] stop -> 200 {'ok': True, 'message': 'Stack n8n stop completed'} +23:25:30 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'n8n', 'volumes_removed': ['n8n_n8n_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem +23:25:38 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/_negative-control/box-verdict-privatebin.json b/documentation/audits/security-2026-11-02/walks/_negative-control/box-verdict-privatebin.json new file mode 100644 index 00000000..c341ba8f --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_negative-control/box-verdict-privatebin.json @@ -0,0 +1,188 @@ +{ + "app": "privatebin", + "walk": "security", + "box_walk_version": 1, + "verdict": "failed", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "privatebin": "privatebin/pdo:2.1.0" + }, + "to": { + "privatebin": "busybox:1.36.1" + }, + "observables_before": { + "pinned_images": { + "privatebin": "privatebin/pdo:2.1.0" + }, + "installed_images": { + "privatebin": "privatebin/pdo:2.1.0" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: privatebin/pdo:2.1.0@sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055" + ], + "docker_inspect": [ + "privatebin privatebin/pdo:2.1.0@sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "200", + "redirect": null + }, + "script": { + "status": "200", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "8942a5012b33", + "sync_waited_s": 15.7, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T21:49:01Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "checking", + "label": "Ellenőrzés…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 1.1, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 2.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 4.1, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 5.2, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 307.3, + "phase": "undoing", + "label": "Visszaállítás az előző változatra…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 314.4, + "phase": "undone", + "label": "Visszaállítva az előző változatra", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 314.4, + "final_phase": "undone", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "privatebin": "privatebin/pdo:2.1.0" + }, + "installed_images": { + "privatebin": "privatebin/pdo:2.1.0" + }, + "catalog_images": { + "privatebin": "busybox:1.36.1" + }, + "live_compose_image_lines": [ + "image: privatebin/pdo:2.1.0@sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055" + ], + "docker_inspect": [ + "privatebin privatebin/pdo:2.1.0@sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "privatebin": "sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055" + }, + "why": "the update ended 'undone' (error None, hold None)", + "log": [ + "22:48:17 [5] the box's drill mirror now at 313eaf68", + "22:48:22 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "22:48:32 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.1.0'}", + "22:48:36 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}", + "22:48:36 privatebin: seeded paste id=2cfd352b43feab34", + "22:48:36 privatebin: readback http=200 marker_present=True", + "22:48:37 [5] drill commit 8942a5012b33: privatebin privatebin/pdo:2.1.0 -> busybox:1.36.1 (push rc=0)", + "22:48:45 [5] the box's drill mirror now at 8942a501", + "22:49:01 [sync] the badge needed 15.7s and 2 sync+rescan rounds to catch up to busybox:1.36.1 — R-607's window, measured", + "22:49:01 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "22:49:01 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None", + "22:49:02 + 1.1s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "22:49:04 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "22:49:05 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "22:49:06 + 4.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "22:49:07 + 5.2s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "22:54:09 + 307.3s phase=undoing label=Visszaállítás az előző változatra… err=None hold=None", + "22:54:16 + 314.4s phase=undone label=Visszaállítva az előző változatra err=None hold=None" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/_negative-control/walk.txt b/documentation/audits/security-2026-11-02/walks/_negative-control/walk.txt new file mode 100644 index 00000000..a5def1bd --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_negative-control/walk.txt @@ -0,0 +1,23 @@ +22:48:17 [5] the box's drill mirror now at 313eaf68 +22:48:22 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +22:48:32 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.1.0'} +22:48:36 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}} +22:48:36 privatebin: seeded paste id=2cfd352b43feab34 +22:48:36 privatebin: readback http=200 marker_present=True +22:48:37 [5] drill commit 8942a5012b33: privatebin privatebin/pdo:2.1.0 -> busybox:1.36.1 (push rc=0) +22:48:45 [5] the box's drill mirror now at 8942a501 +22:49:01 [sync] the badge needed 15.7s and 2 sync+rescan rounds to catch up to busybox:1.36.1 — R-607's window, measured +22:49:01 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +22:49:01 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None +22:49:02 + 1.1s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +22:49:04 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +22:49:05 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None +22:49:06 + 4.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +22:49:07 + 5.2s phase=verifying label=Működés ellenőrzése… err=None hold=None +22:54:09 + 307.3s phase=undoing label=Visszaállítás az előző változatra… err=None hold=None +22:54:16 + 314.4s phase=undone label=Visszaállítva az előző változatra err=None hold=None +22:54:35 [9] verdict failed -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/_negative-control/verdict.json +22:54:35 RESULT failed — the update ended 'undone' (error None, hold None) +22:54:35 [X] stop -> 200 {'ok': True, 'message': 'Stack privatebin stop completed'} +22:55:07 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'privatebin', 'volumes_removed': ['privatebin_privatebin_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note' +22:55:15 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/box-verdict-vaultwarden.json b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/box-verdict-vaultwarden.json new file mode 100644 index 00000000..2735d3c4 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/box-verdict-vaultwarden.json @@ -0,0 +1,47 @@ +{ + "app": "vaultwarden", + "walk": "security", + "box_walk_version": 1, + "verdict": "inconclusive", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "to": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "observables_before": { + "pinned_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "installed_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb" + ], + "docker_inspect": [ + "vaultwarden vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "why": "C1: the fixture could not seed and read back before the update", + "log": [ + "23:39:35 [5] the box's drill mirror now at d50c16f5", + "23:39:39 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:39:54 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}", + "23:39:58 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}", + "23:39:58 vaultwarden: self-registration http=404 (closed by design, R-512 — 400 expected)", + "23:40:01 vaultwarden: POST /identity/accounts/register -> 404 (sign-up closed by design); the admin invite was NOT tried: bench — not the bench venue (the box walk never holds an admin secret); box — the box is not on the drill catalog — not a test run" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/walk.txt b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/walk.txt new file mode 100644 index 00000000..223085b1 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try2-guard-mirror/walk.txt @@ -0,0 +1,11 @@ +23:39:35 [5] the box's drill mirror now at d50c16f5 +23:39:39 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:39:54 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'} +23:39:58 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}} +23:39:58 vaultwarden: self-registration http=404 (closed by design, R-512 — 400 expected) +23:40:01 vaultwarden: POST /identity/accounts/register -> 404 (sign-up closed by design); the admin invite was NOT tried: bench — not the bench venue (the box walk never holds an admin secret); box — the box is not on the drill catalog — not a test run +23:40:01 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/vaultwarden/verdict.json +23:40:01 RESULT inconclusive — C1: the fixture could not seed and read back before the update +23:40:01 [X] stop -> 200 {'ok': True, 'message': 'Stack vaultwarden stop completed'} +23:40:33 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'vaultwarden', 'volumes_removed': ['vaultwarden_vaultwarden_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_no +23:40:42 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/_vaultwarden-try3-route-moved/box-verdict-vaultwarden.json b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try3-route-moved/box-verdict-vaultwarden.json new file mode 100644 index 00000000..39fbe826 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try3-route-moved/box-verdict-vaultwarden.json @@ -0,0 +1,49 @@ +{ + "app": "vaultwarden", + "walk": "security", + "box_walk_version": 1, + "verdict": "inconclusive", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "to": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "observables_before": { + "pinned_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "installed_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb" + ], + "docker_inspect": [ + "vaultwarden vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "why": "C1: the fixture could not seed and read back before the update", + "log": [ + "00:10:17 [5] the box's drill mirror now at ab6bd395f", + "00:10:21 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "00:10:46 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}", + "00:10:50 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}", + "00:10:50 vaultwarden: self-registration http=404 (closed by design, R-512 — 400 expected)", + "00:10:56 vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200')", + "00:10:56 vaultwarden: invited registration http=404", + "00:10:56 vaultwarden: refused \n\n\n \n + + + 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "00:12:44 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}", + "00:12:47 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}", + "00:12:47 vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected)", + "00:12:54 vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200')", + "00:12:54 vaultwarden: invited registration http=400", + "00:12:54 vaultwarden: refused {\"message\":\"Registration is missing required parameters\",\"validationErrors\":{\"\":[\"Registration is missing required parameters\"]},\"errorModel\":{\"message\":\"Registration is missing required parameters\",\"" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/_vaultwarden-try4-needs-token/walk.txt b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try4-needs-token/walk.txt new file mode 100644 index 00000000..f7d622e6 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/_vaultwarden-try4-needs-token/walk.txt @@ -0,0 +1,13 @@ +00:12:24 [5] the box's drill mirror now at ab6bd395f +00:12:29 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +00:12:44 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'} +00:12:47 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}} +00:12:47 vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected) +00:12:54 vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200') +00:12:54 vaultwarden: invited registration http=400 +00:12:54 vaultwarden: refused {"message":"Registration is missing required parameters","validationErrors":{"":["Registration is missing required parameters"]},"errorModel":{"message":"Registration is missing required parameters"," +00:12:54 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/vaultwarden/verdict.json +00:12:54 RESULT inconclusive — C1: the fixture could not seed and read back before the update +00:12:54 [X] stop -> 200 {'ok': True, 'message': 'Stack vaultwarden stop completed'} +00:13:26 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'vaultwarden', 'volumes_removed': ['vaultwarden_vaultwarden_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_no +00:13:34 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/actualbudget/box-verdict-actualbudget.json b/documentation/audits/security-2026-11-02/walks/actualbudget/box-verdict-actualbudget.json new file mode 100644 index 00000000..523bae89 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/actualbudget/box-verdict-actualbudget.json @@ -0,0 +1,225 @@ +{ + "app": "actualbudget", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "actualbudget": "actualbudget/actual-server:26.9.0" + }, + "to": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "observables_before": { + "pinned_images": { + "actualbudget": "actualbudget/actual-server:26.9.0" + }, + "installed_images": { + "actualbudget": "actualbudget/actual-server:26.9.0" + }, + "catalog_images": { + "actualbudget": "actualbudget/actual-server:26.9.0" + }, + "live_compose_image_lines": [ + "image: actualbudget/actual-server:26.9.0@sha256:552beab3dec8c93d46b8b9245612d63c3f123b8a45063a474f53e229b17621d3" + ], + "docker_inspect": [ + "actualbudget actualbudget/actual-server:26.9.0@sha256:552beab3dec8c93d46b8b9245612d63c3f123b8a45063a474f53e229b17621d3 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "b6efe8acd65a", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T22:41:43Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 2.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 15.4, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 19.5, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 30.8, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 30.8, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "installed_images": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "catalog_images": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "live_compose_image_lines": [ + "image: actualbudget/actual-server:26.11.0" + ], + "docker_inspect": [ + "actualbudget actualbudget/actual-server:26.11.0 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "actualbudget": "sha256:06cf186569cf58d93e12659ff1a517b65b5b0ebee7050a3991d4bd8a1d398da6" + }, + "four_observables": { + "pinned": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "installed": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "catalog": { + "actualbudget": "actualbudget/actual-server:26.11.0" + }, + "live_compose": [ + "actualbudget/actual-server:26.11.0" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "200", + "redirect": null + }, + "script": { + "status": "200", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "actualbudget": { + "samples": 60, + "anon_peak_bytes": 45072384, + "limit_bytes": 268435456, + "anon_peak_pct": 16.8, + "anon_live_peak_bytes": 45072384, + "anon_live_peak_pct": 16.8, + "cgroup_peak_pct": 36.6, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-e612b1afedea314c8e0de7b674f03913cd8401a22b27431d1458b14c74479925.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 16.8, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "23:40:55 [5] the box's drill mirror now at d50c16f5", + "23:40:59 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:41:24 [1] deployed, controller state=running, pinned={'actualbudget': 'actualbudget/actual-server:26.9.0'}", + "23:41:24 gate: budget is gated — passed as the household (cookie set)", + "23:41:28 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "23:41:28 actualbudget: /account/bootstrap http=200 :: {\"status\":\"ok\",\"data\":{\"token\":\"04b22639-d5f9-48bc-a93b-c61688fcefca\"}}", + "23:41:28 actualbudget: login with the seeded password http=200 ok=True", + "23:41:30 [5] drill commit b6efe8acd65a: actualbudget actualbudget/actual-server:26.9.0 -> actualbudget/actual-server:26.11.0 (push rc=0)", + "23:41:39 [5] the box's drill mirror now at b6efe8acd", + "23:41:43 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "23:41:44 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "23:41:46 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "23:41:47 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "23:41:59 + 15.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "23:42:03 + 19.5s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "23:42:14 + 30.8s phase=done label=Frissítve err=None hold=None", + "23:42:33 actualbudget: login with the seeded password http=200 ok=True", + "23:42:33 [7] memory soak 600 s …", + "23:52:40 [7] soak: peak 16.8% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/actualbudget/walk.txt b/documentation/audits/security-2026-11-02/walks/actualbudget/walk.txt new file mode 100644 index 00000000..f1faf11b --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/actualbudget/walk.txt @@ -0,0 +1,24 @@ +23:40:55 [5] the box's drill mirror now at d50c16f5 +23:40:59 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:41:24 [1] deployed, controller state=running, pinned={'actualbudget': 'actualbudget/actual-server:26.9.0'} +23:41:24 gate: budget is gated — passed as the household (cookie set) +23:41:28 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +23:41:28 actualbudget: /account/bootstrap http=200 :: {"status":"ok","data":{"token":"04b22639-d5f9-48bc-a93b-c61688fcefca"}} +23:41:28 actualbudget: login with the seeded password http=200 ok=True +23:41:30 [5] drill commit b6efe8acd65a: actualbudget actualbudget/actual-server:26.9.0 -> actualbudget/actual-server:26.11.0 (push rc=0) +23:41:39 [5] the box's drill mirror now at b6efe8acd +23:41:43 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +23:41:44 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +23:41:46 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +23:41:47 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None +23:41:59 + 15.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +23:42:03 + 19.5s phase=verifying label=Működés ellenőrzése… err=None hold=None +23:42:14 + 30.8s phase=done label=Frissítve err=None hold=None +23:42:33 actualbudget: login with the seeded password http=200 ok=True +23:42:33 [7] memory soak 600 s … +23:52:40 [7] soak: peak 16.8% of the limit (anon), kills 0, restarts 0 +23:52:40 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/actualbudget/verdict.json +23:52:40 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +23:52:40 [X] stop -> 200 {'ok': True, 'message': 'Stack actualbudget stop completed'} +23:53:12 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'actualbudget', 'volumes_removed': ['actualbudget_actualbudget_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd +23:53:20 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/gitea/box-verdict-gitea.json b/documentation/audits/security-2026-11-02/walks/gitea/box-verdict-gitea.json new file mode 100644 index 00000000..1868814a --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/gitea/box-verdict-gitea.json @@ -0,0 +1,228 @@ +{ + "app": "gitea", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "gitea": "gitea/gitea:28.2.0" + }, + "to": { + "gitea": "gitea/gitea:28.3.0" + }, + "observables_before": { + "pinned_images": { + "gitea": "gitea/gitea:28.2.0" + }, + "installed_images": { + "gitea": "gitea/gitea:28.2.0" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: gitea/gitea:28.2.0@sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504" + ], + "docker_inspect": [ + "gitea gitea/gitea:28.2.0@sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504 running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "61aedd222a9d", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T21:56:24Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 4.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 7.2, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 10.3, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 15.4, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 15.4, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "gitea": "gitea/gitea:28.3.0" + }, + "installed_images": { + "gitea": "gitea/gitea:28.3.0" + }, + "catalog_images": { + "gitea": "gitea/gitea:28.3.0" + }, + "live_compose_image_lines": [ + "image: gitea/gitea:28.3.0" + ], + "docker_inspect": [ + "gitea gitea/gitea:28.3.0 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "gitea": "sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d" + }, + "four_observables": { + "pinned": { + "gitea": "gitea/gitea:28.3.0" + }, + "installed": { + "gitea": "gitea/gitea:28.3.0" + }, + "catalog": { + "gitea": "gitea/gitea:28.3.0" + }, + "live_compose": [ + "gitea/gitea:28.3.0" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "gitea": { + "samples": 60, + "anon_peak_bytes": 102752256, + "limit_bytes": 536870912, + "anon_peak_pct": 19.1, + "anon_live_peak_bytes": 102748160, + "anon_live_peak_pct": 19.1, + "cgroup_peak_pct": 48.7, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-73520e598d3f09e58109f7360a5af17a6708d5471fa5eb6a472e957201f21459.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 19.1, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "22:55:29 [5] the box's drill mirror now at 313eaf68", + "22:55:34 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "22:55:54 [1] deployed, controller state=running, pinned={'gitea': 'gitea/gitea:28.2.0'}", + "22:55:54 gate: git is gated — passed as the household (cookie set)", + "22:55:58 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "22:56:03 gitea: first-run installer POST / http=200", + "22:56:09 gitea: installed through its own first-run form; the admin authenticates", + "22:56:10 gitea: create repo http=201", + "22:56:10 gitea: one commit (drill.txt) http=201", + "22:56:10 gitea: the committed file read back http=200 same=True", + "22:56:10 gitea: readback of the seeded repo http=200 ok=True", + "22:56:11 [5] drill commit 61aedd222a9d: gitea gitea/gitea:28.2.0 -> gitea/gitea:28.3.0 (push rc=0)", + "22:56:20 [5] the box's drill mirror now at 61aedd22", + "22:56:25 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "22:56:25 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "22:56:28 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "22:56:29 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "22:56:32 + 7.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "22:56:35 + 10.3s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "22:56:40 + 15.4s phase=done label=Frissítve err=None hold=None", + "22:56:59 gitea: the committed file read back http=200 same=True", + "22:56:59 gitea: readback of the seeded repo http=200 ok=True", + "22:56:59 [7] memory soak 600 s …", + "23:07:05 [7] soak: peak 19.1% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/gitea/walk.txt b/documentation/audits/security-2026-11-02/walks/gitea/walk.txt new file mode 100644 index 00000000..a4c73999 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/gitea/walk.txt @@ -0,0 +1,29 @@ +22:55:29 [5] the box's drill mirror now at 313eaf68 +22:55:34 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +22:55:54 [1] deployed, controller state=running, pinned={'gitea': 'gitea/gitea:28.2.0'} +22:55:54 gate: git is gated — passed as the household (cookie set) +22:55:58 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +22:56:03 gitea: first-run installer POST / http=200 +22:56:09 gitea: installed through its own first-run form; the admin authenticates +22:56:10 gitea: create repo http=201 +22:56:10 gitea: one commit (drill.txt) http=201 +22:56:10 gitea: the committed file read back http=200 same=True +22:56:10 gitea: readback of the seeded repo http=200 ok=True +22:56:11 [5] drill commit 61aedd222a9d: gitea gitea/gitea:28.2.0 -> gitea/gitea:28.3.0 (push rc=0) +22:56:20 [5] the box's drill mirror now at 61aedd22 +22:56:25 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +22:56:25 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +22:56:28 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +22:56:29 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None +22:56:32 + 7.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +22:56:35 + 10.3s phase=verifying label=Működés ellenőrzése… err=None hold=None +22:56:40 + 15.4s phase=done label=Frissítve err=None hold=None +22:56:59 gitea: the committed file read back http=200 same=True +22:56:59 gitea: readback of the seeded repo http=200 ok=True +22:56:59 [7] memory soak 600 s … +23:07:05 [7] soak: peak 19.1% of the limit (anon), kills 0, restarts 0 +23:07:05 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/gitea/verdict.json +23:07:05 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +23:07:05 [X] stop -> 200 {'ok': True, 'message': 'Stack gitea stop completed'} +23:07:37 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'gitea', 'volumes_removed': ['gitea_gitea_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazá +23:07:46 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/grafana/box-verdict-grafana.json b/documentation/audits/security-2026-11-02/walks/grafana/box-verdict-grafana.json new file mode 100644 index 00000000..c185292a --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/grafana/box-verdict-grafana.json @@ -0,0 +1,223 @@ +{ + "app": "grafana", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "grafana": "grafana/grafana:13.2.4" + }, + "to": { + "grafana": "grafana/grafana:13.2.5" + }, + "observables_before": { + "pinned_images": { + "grafana": "grafana/grafana:13.2.4" + }, + "installed_images": { + "grafana": "grafana/grafana:13.2.4" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: grafana/grafana:13.2.4@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f" + ], + "docker_inspect": [ + "grafana grafana/grafana:13.2.4@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "/login?…" + }, + "script": { + "status": "302", + "redirect": "/login?…" + } + }, + "seed": "read_back", + "drill_commit": "d50c16f5f0b2", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T22:27:16Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 12.3, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 14.4, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 35.9, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 49.2, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 54.4, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 54.4, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "grafana": "grafana/grafana:13.2.5" + }, + "installed_images": { + "grafana": "grafana/grafana:13.2.5" + }, + "catalog_images": { + "grafana": "grafana/grafana:13.2.5" + }, + "live_compose_image_lines": [ + "image: grafana/grafana:13.2.5" + ], + "docker_inspect": [ + "grafana grafana/grafana:13.2.5 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "grafana": "sha256:9f7aa1e1e3246aade5792d35a738049f7f32f89cd51d1956cf426a4e86268a84" + }, + "four_observables": { + "pinned": { + "grafana": "grafana/grafana:13.2.5" + }, + "installed": { + "grafana": "grafana/grafana:13.2.5" + }, + "catalog": { + "grafana": "grafana/grafana:13.2.5" + }, + "live_compose": [ + "grafana/grafana:13.2.5" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "/login?…" + }, + "script": { + "status": "302", + "redirect": "/login?…" + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "grafana": { + "samples": 60, + "anon_peak_bytes": 252518400, + "limit_bytes": 805306368, + "anon_peak_pct": 31.4, + "anon_live_peak_bytes": 252510208, + "anon_live_peak_pct": 31.4, + "cgroup_peak_pct": 69.4, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-b647971372c3aa55d5930ad9c95b0453337b334e7b16f5ff6db8d0141ab7ed43.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 31.4, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "23:25:51 [5] the box's drill mirror now at 3cabefca", + "23:25:55 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD']", + "23:25:56 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:26:56 [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.4'}", + "23:27:00 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': '/login?…'}, 'script': {'status': '302', 'redirect': '/login?…'}}", + "23:27:01 grafana: create folder http=200", + "23:27:01 grafana: readback of the seeded folder http=200 ok=True", + "23:27:02 [5] drill commit d50c16f5f0b2: grafana grafana/grafana:13.2.4 -> grafana/grafana:13.2.5 (push rc=0)", + "23:27:12 [5] the box's drill mirror now at d50c16f5", + "23:27:17 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "23:27:17 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "23:27:29 + 12.3s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "23:27:31 + 14.4s phase=pulling label=Új verzió letöltése… err=None hold=None", + "23:27:53 + 35.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "23:28:06 + 49.2s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "23:28:11 + 54.4s phase=done label=Frissítve err=None hold=None", + "23:28:30 grafana: readback of the seeded folder http=200 ok=True", + "23:28:30 [7] memory soak 600 s …", + "23:38:36 [7] soak: peak 31.4% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/grafana/walk.txt b/documentation/audits/security-2026-11-02/walks/grafana/walk.txt new file mode 100644 index 00000000..81820a27 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/grafana/walk.txt @@ -0,0 +1,24 @@ +23:25:51 [5] the box's drill mirror now at 3cabefca +23:25:55 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD'] +23:25:56 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:26:56 [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.4'} +23:27:00 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': '/login?…'}, 'script': {'status': '302', 'redirect': '/login?…'}} +23:27:01 grafana: create folder http=200 +23:27:01 grafana: readback of the seeded folder http=200 ok=True +23:27:02 [5] drill commit d50c16f5f0b2: grafana grafana/grafana:13.2.4 -> grafana/grafana:13.2.5 (push rc=0) +23:27:12 [5] the box's drill mirror now at d50c16f5 +23:27:17 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +23:27:17 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +23:27:29 + 12.3s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +23:27:31 + 14.4s phase=pulling label=Új verzió letöltése… err=None hold=None +23:27:53 + 35.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +23:28:06 + 49.2s phase=verifying label=Működés ellenőrzése… err=None hold=None +23:28:11 + 54.4s phase=done label=Frissítve err=None hold=None +23:28:30 grafana: readback of the seeded folder http=200 ok=True +23:28:30 [7] memory soak 600 s … +23:38:36 [7] soak: peak 31.4% of the limit (anon), kills 0, restarts 0 +23:38:36 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/grafana/verdict.json +23:38:36 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +23:38:37 [X] stop -> 200 {'ok': True, 'message': 'Stack grafana stop completed'} +23:39:09 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'grafana', 'volumes_removed': ['grafana_grafana_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk +23:39:17 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/n8n/box-verdict-n8n.json b/documentation/audits/security-2026-11-02/walks/n8n/box-verdict-n8n.json new file mode 100644 index 00000000..b008243a --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/n8n/box-verdict-n8n.json @@ -0,0 +1,232 @@ +{ + "app": "n8n", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "n8n": "n8nio/n8n:2.44.7" + }, + "to": { + "n8n": "n8nio/n8n:2.46.4" + }, + "observables_before": { + "pinned_images": { + "n8n": "n8nio/n8n:2.44.7" + }, + "installed_images": { + "n8n": "n8nio/n8n:2.44.7" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: n8nio/n8n:2.44.7@sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b" + ], + "docker_inspect": [ + "n8n n8nio/n8n:2.44.7@sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "ab6bd395f168", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T22:56:31Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 4.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 5.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 114.8, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 118.8, + "phase": "starting", + "label": "Indítás az új verzióval…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 119.9, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 135.3, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 135.3, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "n8n": "n8nio/n8n:2.46.4" + }, + "installed_images": { + "n8n": "n8nio/n8n:2.46.4" + }, + "catalog_images": { + "n8n": "n8nio/n8n:2.46.4" + }, + "live_compose_image_lines": [ + "image: n8nio/n8n:2.46.4" + ], + "docker_inspect": [ + "n8n n8nio/n8n:2.46.4 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "n8n": "sha256:4384b9ff20a78bc1708c35ce7864f84f724611de7801fb36d715998db7c000f1" + }, + "four_observables": { + "pinned": { + "n8n": "n8nio/n8n:2.46.4" + }, + "installed": { + "n8n": "n8nio/n8n:2.46.4" + }, + "catalog": { + "n8n": "n8nio/n8n:2.46.4" + }, + "live_compose": [ + "n8nio/n8n:2.46.4" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "200", + "redirect": null + }, + "script": { + "status": "200", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "n8n": { + "samples": 60, + "anon_peak_bytes": 403980288, + "limit_bytes": 1610612736, + "anon_peak_pct": 25.1, + "anon_live_peak_bytes": 403980288, + "anon_live_peak_pct": 25.1, + "cgroup_peak_pct": 46.2, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-ceb0b76c7b227cd2b67987f90f69bd1e106a09fd6d762de620c5cfc8e4f58ad8.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 25.1, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "23:53:42 [5] the box's drill mirror now at b6efe8acd", + "23:53:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:56:02 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.44.7'}", + "23:56:02 gate: auto is gated — passed as the household (cookie set)", + "23:56:06 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "23:56:16 n8n: /rest/owner/setup http=200", + "23:56:16 n8n: login as the seeded owner http=200 ok=True", + "23:56:17 [5] drill commit ab6bd395f168: n8n n8nio/n8n:2.44.7 -> n8nio/n8n:2.46.4 (push rc=0)", + "23:56:26 [5] the box's drill mirror now at ab6bd395f", + "23:56:31 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "23:56:31 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "23:56:35 + 4.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "23:56:36 + 5.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "23:58:26 + 114.8s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "23:58:30 + 118.8s phase=starting label=Indítás az új verzióval… err=None hold=None", + "23:58:31 + 119.9s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "23:58:46 + 135.3s phase=done label=Frissítve err=None hold=None", + "23:59:05 n8n: login as the seeded owner http=200 ok=True", + "23:59:05 [7] memory soak 600 s …", + "00:09:11 [7] soak: peak 25.1% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/n8n/walk.txt b/documentation/audits/security-2026-11-02/walks/n8n/walk.txt new file mode 100644 index 00000000..7b9b10c1 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/n8n/walk.txt @@ -0,0 +1,25 @@ +23:53:42 [5] the box's drill mirror now at b6efe8acd +23:53:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:56:02 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.44.7'} +23:56:02 gate: auto is gated — passed as the household (cookie set) +23:56:06 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +23:56:16 n8n: /rest/owner/setup http=200 +23:56:16 n8n: login as the seeded owner http=200 ok=True +23:56:17 [5] drill commit ab6bd395f168: n8n n8nio/n8n:2.44.7 -> n8nio/n8n:2.46.4 (push rc=0) +23:56:26 [5] the box's drill mirror now at ab6bd395f +23:56:31 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +23:56:31 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +23:56:35 + 4.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +23:56:36 + 5.1s phase=pulling label=Új verzió letöltése… err=None hold=None +23:58:26 + 114.8s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +23:58:30 + 118.8s phase=starting label=Indítás az új verzióval… err=None hold=None +23:58:31 + 119.9s phase=verifying label=Működés ellenőrzése… err=None hold=None +23:58:46 + 135.3s phase=done label=Frissítve err=None hold=None +23:59:05 n8n: login as the seeded owner http=200 ok=True +23:59:05 [7] memory soak 600 s … +00:09:11 [7] soak: peak 25.1% of the limit (anon), kills 0, restarts 0 +00:09:11 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/n8n/verdict.json +00:09:11 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +00:09:12 [X] stop -> 200 {'ok': True, 'message': 'Stack n8n stop completed'} +00:09:44 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'n8n', 'volumes_removed': ['n8n_n8n_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem +00:09:53 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/uptime-kuma/box-verdict-uptime-kuma.json b/documentation/audits/security-2026-11-02/walks/uptime-kuma/box-verdict-uptime-kuma.json new file mode 100644 index 00000000..0e741df3 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/uptime-kuma/box-verdict-uptime-kuma.json @@ -0,0 +1,224 @@ +{ + "app": "uptime-kuma", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "uptime-kuma": "louislam/uptime-kuma:2.5.7" + }, + "to": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "observables_before": { + "pinned_images": { + "uptime-kuma": "louislam/uptime-kuma:2.5.7" + }, + "installed_images": { + "uptime-kuma": "louislam/uptime-kuma:2.5.7" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: louislam/uptime-kuma:2.5.7@sha256:4b95dbe7ac5343b768f8e04e3035ccd59997872b1a35ab9b0f082d2cc279070e" + ], + "docker_inspect": [ + "uptime-kuma louislam/uptime-kuma:2.5.7@sha256:4b95dbe7ac5343b768f8e04e3035ccd59997872b1a35ab9b0f082d2cc279070e running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "3cabefcae780", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető — ma" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available — today" + } + ] + }, + "measured_at": "2026-11-02T22:10:43Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 6.2, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 7.2, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 23.6, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 30.8, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 35.9, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 35.9, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "installed_images": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "catalog_images": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "live_compose_image_lines": [ + "image: louislam/uptime-kuma:2.5.9" + ], + "docker_inspect": [ + "uptime-kuma louislam/uptime-kuma:2.5.9 running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "uptime-kuma": "sha256:e88415a90dd2f7efecdbc18de0490aff292764a3ac471531bf1d0481725591bd" + }, + "four_observables": { + "pinned": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "installed": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "catalog": { + "uptime-kuma": "louislam/uptime-kuma:2.5.9" + }, + "live_compose": [ + "louislam/uptime-kuma:2.5.9" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "302", + "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…" + }, + "script": { + "status": "401", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "uptime-kuma": { + "samples": 60, + "anon_peak_bytes": 105209856, + "limit_bytes": 402653184, + "anon_peak_pct": 26.1, + "anon_live_peak_bytes": 105209856, + "anon_live_peak_pct": 26.1, + "cgroup_peak_pct": 31.3, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-f24f97a04660bd3f3047b7d7d55515ce80f04ccaf94c9c96ea8969f229c573e0.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 26.1, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "23:09:20 [5] the box's drill mirror now at 61aedd22", + "23:09:25 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "23:10:25 [1] deployed, controller state=running, pinned={'uptime-kuma': 'louislam/uptime-kuma:2.5.7'}", + "23:10:25 gate: status is gated — passed as the household (cookie set)", + "23:10:28 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}", + "23:10:29 uptime-kuma: setup ok=True successAdded", + "23:10:29 uptime-kuma: addStatusPage ok=True successAdded", + "23:10:29 uptime-kuma: readback of the seeded status page http=200 found=True", + "23:10:30 [5] drill commit 3cabefcae780: uptime-kuma louislam/uptime-kuma:2.5.7 -> louislam/uptime-kuma:2.5.9 (push rc=0)", + "23:10:38 [5] the box's drill mirror now at 3cabefca", + "23:10:43 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "23:10:43 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "23:10:49 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "23:10:50 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None", + "23:11:07 + 23.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "23:11:14 + 30.8s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "23:11:19 + 35.9s phase=done label=Frissítve err=None hold=None", + "23:11:38 uptime-kuma: readback of the seeded status page http=200 found=True", + "23:11:38 [7] memory soak 600 s …", + "23:21:44 [7] soak: peak 26.1% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/uptime-kuma/walk.txt b/documentation/audits/security-2026-11-02/walks/uptime-kuma/walk.txt new file mode 100644 index 00000000..07b6a0c8 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/uptime-kuma/walk.txt @@ -0,0 +1,25 @@ +23:09:20 [5] the box's drill mirror now at 61aedd22 +23:09:25 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +23:10:25 [1] deployed, controller state=running, pinned={'uptime-kuma': 'louislam/uptime-kuma:2.5.7'} +23:10:25 gate: status is gated — passed as the household (cookie set) +23:10:28 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}} +23:10:29 uptime-kuma: setup ok=True successAdded +23:10:29 uptime-kuma: addStatusPage ok=True successAdded +23:10:29 uptime-kuma: readback of the seeded status page http=200 found=True +23:10:30 [5] drill commit 3cabefcae780: uptime-kuma louislam/uptime-kuma:2.5.7 -> louislam/uptime-kuma:2.5.9 (push rc=0) +23:10:38 [5] the box's drill mirror now at 3cabefca +23:10:43 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +23:10:43 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +23:10:49 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +23:10:50 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None +23:11:07 + 23.6s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +23:11:14 + 30.8s phase=verifying label=Működés ellenőrzése… err=None hold=None +23:11:19 + 35.9s phase=done label=Frissítve err=None hold=None +23:11:38 uptime-kuma: readback of the seeded status page http=200 found=True +23:11:38 [7] memory soak 600 s … +23:21:44 [7] soak: peak 26.1% of the limit (anon), kills 0, restarts 0 +23:21:44 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/uptime-kuma/verdict.json +23:21:44 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +23:21:48 [X] stop -> 200 {'ok': True, 'message': 'Stack uptime-kuma stop completed'} +23:22:20 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'uptime-kuma', 'volumes_removed': ['uptime-kuma_uptime_kuma_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_no +23:22:29 [X] after remove: deployed=False leftovers='' diff --git a/documentation/audits/security-2026-11-02/walks/vaultwarden/box-verdict-vaultwarden.json b/documentation/audits/security-2026-11-02/walks/vaultwarden/box-verdict-vaultwarden.json new file mode 100644 index 00000000..28d02ab9 --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/vaultwarden/box-verdict-vaultwarden.json @@ -0,0 +1,224 @@ +{ + "app": "vaultwarden", + "walk": "security", + "box_walk_version": 1, + "verdict": "proven", + "venue": "box 9202 (drill catalog), the guarded Update", + "from": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "to": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "observables_before": { + "pinned_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "installed_images": { + "vaultwarden": "vaultwarden/server:1.37.4-alpine" + }, + "catalog_images": null, + "live_compose_image_lines": [ + "image: vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb" + ], + "docker_inspect": [ + "vaultwarden vaultwarden/server:1.37.4-alpine@sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb running=true restarts=0" + ] + }, + "setup_gate_before": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "seed": "read_back", + "drill_commit": "4307005b2746", + "sync_waited_s": 4.5, + "badge_before": { + "hu": [ + { + "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.", + "text": "Frissítés elérhető" + } + ], + "en": [ + { + "title": "A newer version of this app is available. Select the Update button to start it.", + "text": "Update available" + } + ] + }, + "measured_at": "2026-11-02T23:15:11Z", + "update": { + "accepted": true, + "http": "202", + "phases": [ + { + "t": 0.0, + "phase": "backing-up", + "label": "Biztonsági mentés készül a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 2.1, + "phase": "safety-dump", + "label": "Adatbázis pillanatkép…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 3.1, + "phase": "pulling", + "label": "Új verzió letöltése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 6.2, + "phase": "copying", + "label": "Az adatok másolása a frissítés előtt…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 9.2, + "phase": "verifying", + "label": "Működés ellenőrzése…", + "updating": true, + "error": null, + "hold": null + }, + { + "t": 14.3, + "phase": "done", + "label": "Frissítve", + "updating": false, + "error": null, + "hold": null + } + ], + "duration_s": 14.4, + "final_phase": "done", + "update_error": null, + "hold_reason": null, + "state": "running" + }, + "observables_after": { + "pinned_images": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "installed_images": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "catalog_images": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "live_compose_image_lines": [ + "image: vaultwarden/server:1.37.5-alpine" + ], + "docker_inspect": [ + "vaultwarden vaultwarden/server:1.37.5-alpine running=true restarts=0" + ] + }, + "badge_after": { + "hu": [ + { + "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.", + "text": "Naprakész" + } + ], + "en": [ + { + "title": "This app is running the newest version available.", + "text": "Up to date" + } + ] + }, + "state_after": "running", + "hold_after": null, + "to_digests": { + "vaultwarden": "sha256:bbe684a02d6b0db54256ff88eac9754f4519284a7b26314afc241fd7d0918191" + }, + "four_observables": { + "pinned": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "installed": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "catalog": { + "vaultwarden": "vaultwarden/server:1.37.5-alpine" + }, + "live_compose": [ + "vaultwarden/server:1.37.5-alpine" + ] + }, + "seed_read_after": true, + "setup_gate_after": { + "browser": { + "status": "404", + "redirect": null + }, + "script": { + "status": "404", + "redirect": null + } + }, + "memory": { + "soak_s": 600, + "interval_s": 10, + "samples": 60, + "containers": { + "vaultwarden": { + "samples": 60, + "anon_peak_bytes": 29605888, + "limit_bytes": 268435456, + "anon_peak_pct": 11.0, + "anon_live_peak_bytes": 29605888, + "anon_live_peak_pct": 11.0, + "cgroup_peak_pct": 16.2, + "oom_kill_delta": 0, + "oom_killed_flag": false, + "restarts_delta": 0, + "running_all_samples": true, + "cgroup": "/sys/fs/cgroup/system.slice/docker-a1d7493bc426fffb3afe3427c5b4703eb178227d1c4cd9ad7908a79c474b1554.scope" + } + }, + "oom_kills": 0, + "restarts": 0, + "peak_pct": 11.0, + "peak_basis": "anon_live" + }, + "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back", + "log": [ + "00:14:21 [5] the box's drill mirror now at ab6bd395f", + "00:14:26 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}", + "00:14:46 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}", + "00:14:49 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}", + "00:14:49 vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected)", + "00:14:56 vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200')", + "00:14:56 vaultwarden: invited registration http=200", + "00:14:56 vaultwarden: token for the seeded account http=200 ok=True", + "00:14:58 [5] drill commit 4307005b2746: vaultwarden vaultwarden/server:1.37.4-alpine -> vaultwarden/server:1.37.5-alpine (push rc=0)", + "00:15:06 [5] the box's drill mirror now at 4307005b2", + "00:15:11 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}", + "00:15:11 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None", + "00:15:13 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None", + "00:15:14 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None", + "00:15:17 + 6.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None", + "00:15:20 + 9.2s phase=verifying label=Működés ellenőrzése… err=None hold=None", + "00:15:25 + 14.3s phase=done label=Frissítve err=None hold=None", + "00:15:44 vaultwarden: token for the seeded account http=200 ok=True", + "00:15:44 [7] memory soak 600 s …", + "00:25:50 [7] soak: peak 11.0% of the limit (anon), kills 0, restarts 0" + ] +} \ No newline at end of file diff --git a/documentation/audits/security-2026-11-02/walks/vaultwarden/walk.txt b/documentation/audits/security-2026-11-02/walks/vaultwarden/walk.txt new file mode 100644 index 00000000..9534a0ff --- /dev/null +++ b/documentation/audits/security-2026-11-02/walks/vaultwarden/walk.txt @@ -0,0 +1,25 @@ +00:14:21 [5] the box's drill mirror now at ab6bd395f +00:14:26 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +00:14:46 [1] deployed, controller state=running, pinned={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'} +00:14:49 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}} +00:14:49 vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected) +00:14:56 vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200') +00:14:56 vaultwarden: invited registration http=200 +00:14:56 vaultwarden: token for the seeded account http=200 ok=True +00:14:58 [5] drill commit 4307005b2746: vaultwarden vaultwarden/server:1.37.4-alpine -> vaultwarden/server:1.37.5-alpine (push rc=0) +00:15:06 [5] the box's drill mirror now at 4307005b2 +00:15:11 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'} +00:15:11 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None +00:15:13 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None +00:15:14 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None +00:15:17 + 6.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None +00:15:20 + 9.2s phase=verifying label=Működés ellenőrzése… err=None hold=None +00:15:25 + 14.3s phase=done label=Frissítve err=None hold=None +00:15:44 vaultwarden: token for the seeded account http=200 ok=True +00:15:44 [7] memory soak 600 s … +00:25:50 [7] soak: peak 11.0% of the limit (anon), kills 0, restarts 0 +00:25:50 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-2026-11-02/walks/vaultwarden/verdict.json +00:25:50 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back +00:25:52 [X] stop -> 200 {'ok': True, 'message': 'Stack vaultwarden stop completed'} +00:26:24 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'vaultwarden', 'volumes_removed': ['vaultwarden_vaultwarden_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_no +00:26:33 [X] after remove: deployed=False leftovers=''