security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed
gates / gates (push) Successful in 3m27s
gates / gates (push) Successful in 3m27s
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io). - security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images, filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step). - dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d). - Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved. - audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log. - 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
This commit is contained in:
admin committed
1 parent
503692a1da
commit
f5a4995da5
21 files changed
+3498
-29
No files matched your search
@@ -0,0 +1,41 @@
|
||||
# DooPlex (homelab) — what to update, from the security watch (R-1328)
|
||||
|
||||
Read only: Felhom changes nothing on DooPlex. Source: the watch's run of 2026-10-27 night over
|
||||
`documentation/security-watch/dooplex-workloads.txt` (homelab-manifests `image:` lines; Helm-chart images are NOT
|
||||
in it). „Catalog ahead" = the Felhom catalog already ships a different (walked) tag of the same image.
|
||||
|
||||
| Image | DooPlex tag | Where | What is bad (fixed in) | Catalog ahead |
|
||||
|---|---|---|---|---|
|
||||
| `actualbudget/actual-server` | `26.10.0` | actualbudget-system/actualbudget.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `26.9.0` |
|
||||
| `advplyr/audiobookshelf` | `2.37.1` | audiobookshelf-system/audiobookshelf.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |
|
||||
| `codewithcj/sparkyfitness_server` | `v1.9.0` | workout-system/sparkyfitness.yaml | CVE-2026-111497 — Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `v0.17.3` |
|
||||
| `crocodilestick/calibre-web-automated` | `dev` | calibre-system/cwa.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `v4.0.8` |
|
||||
| `docker.io/calcom/cal.com` | `v6.2.0` | booking-system/booking.yaml | CVE-2026-111497 — Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4, 24.22.1, 26.12.1) | — |
|
||||
| `flomp/wanderer-db` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
|
||||
| `flomp/wanderer-web` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
|
||||
| `ghcr.io/gethomepage/homepage` | `v1.13.2` | homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml | GHSA-669x-4pg4-w24r — Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints (fixed: 2.2.0); CVE-2026-111497 — Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4) | — |
|
||||
| `ghcr.io/immich-app/immich-machine-learning` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
|
||||
| `ghcr.io/immich-app/immich-server` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
|
||||
| `ghcr.io/lukegus/termix` | `release-2.9.2` | termix-system/termix.yaml | CVE-2026-111497 — Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 26.12.1) | `2.8.0` |
|
||||
| `ghcr.io/paperless-ngx/paperless-ngx` | `3.3.4` | paperless-system/paperless.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `2.20.15` |
|
||||
| `gitea/gitea` | `1.26.2` | gitea-system/gitea.yaml | GHSA-wx44-9m3m-rjqx — Locked issues and comments still accept reactions through the web UI (fixed: 28.2.0); GHSA-4jmf-h2cm-hg7w — Cross-Site Request Forgery on `POST /{owner}/{repo}/topics` (fixed: 28.2.0); GHSA-8j56-f865-gqq2 — Draft releases include attachment metadata from other repositories (fixed: 28.2.0) | `1.27.3` |
|
||||
| `grafana/grafana` | `13.2.4` | mon-system/monitoring.yaml | GHSA-8xmm-x63g-f6xv — Stored XSS in ResourcePicker component (fixed: no fixed version named yet); GHSA-4724-7jwc-3fpw — Spoofing originalUrl of snapshots (fixed: the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 — Email addresses and usernames can not be trusted (fixed: the range is unreadable — check by hand) | — |
|
||||
| `louislam/uptime-kuma` | `2.5.6` | uptimekuma-system/uptimekuma.yaml | GHSA-qjxc-h5jf-c7rj — GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extra (fixed: the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 — ⬆️ Security Fixes (fixed: 2.5.8); release:louislam/uptime-kuma@2.5.7 — ⬆️ Security Fixes (fixed: 2.5.7) | `2.5.7` |
|
||||
| `outlinewiki/outline` | `1.11.0` | outline-system/outline.yaml | GHSA-x4w3-9p9j-cprh — users.update_role reveals whether a user id from another team exists and which role it has (fixed: 1.12.0); GHSA-rq53-m97j-f2pg — Unpublished documents remain publicly accessible and their shares cannot be revoked (fixed: 1.12.0); GHSA-h6ff-rw9x-5mq2 — Authenticated members can publish documents into private collections through a retained parent link (fixed: 1.12.0) | `1.12.0` |
|
||||
| `redis` | `8.10.2` | plantit-system/plantit.yaml | GHSA-c8h9-259x-jff4 — Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution (fixed: the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 — Lua Use-After-Free may lead to remote code execution (fixed: no fixed version named yet); GHSA-93m2-935m-8rj3 — Use-After-Free in unblock client flow may lead to remote code execution (fixed: no fixed version named yet) | `7.4-alpine` |
|
||||
| `rommapp/romm` | `5.4.0` | arcade-system/romm.yaml | release:rommapp/romm@5.4.1 — While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible (fixed: 5.4.1); CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `5.4.1` |
|
||||
| `vabene1111/recipes` | `2.6.15` | tandoor-system/tandoor.yaml | CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |
|
||||
|
||||
**19 images to update.**
|
||||
|
||||
## NOT CHECKED (the watch could not read them)
|
||||
|
||||
- `advplyr/audiobookshelf:2.37.1` — https://hub.docker.com/v2/repositories/advplyr/audiobookshelf/tags: The read operation timed out
|
||||
- `gitea.dooplex.hu/admin/felhom-act-runner:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/jarr:latest` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/recipe-importer:latest` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/revfulop-calendar:1.6.2` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/sparkyfitness-export:0.3.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/wan-probe:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `minio/minio:latest` — Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET
|
||||
|
||||
The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python `brotli`
|
||||
(fixed 1.0.10 / 1.1.1 / 1.2.1) / `brotlicffi` (1.2.1.0). Sources read in the session: the CVE record via security
|
||||
press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.
|
||||
|
||||
## What the images carry (read from the registries, `scripts/image_runtime.py`, no pull)
|
||||
|
||||
Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live:
|
||||
1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home
|
||||
Assistant 2026.10.4 Brotli **1.2.1**; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node **24.22.1**.
|
||||
|
||||
**The whole catalog (the watch's filling run, `--no-mail`):** 20 catalog apps and one box program carry a bad runtime
|
||||
(R-1332); DooPlex: 19 images to update (`HOMELAB-LIST.md`, R-1328). Positive controls named: Home Assistant, RomM;
|
||||
negative control audiobookshelf 2.37.2 CURRENT.
|
||||
|
||||
## Steps (drill only — the live push waits for the operator)
|
||||
|
||||
- **Home Assistant 2026.9.4 → 2026.10.4**, a lane step (`09` §3 decision 276): `walks/home-assistant/` — proven on 9202
|
||||
through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart;
|
||||
written to the drill (`3c8ebb5`, superseded step `steps/4f987bb4b035eef9.yml`).
|
||||
- **Immich v3.2.4 → v3.3.5**, a lane step (R-1322): `walks/immich/` (see its walk.txt). 9202's old Immich was removed
|
||||
through the product first (its drive folder kept: the drive path could not be resolved — R-442, right).
|
||||
- **Wanderer hidden** (D59): drill `ee18bff`; the live change is `wanderer-hidden.patch` (not committed to the live
|
||||
catalog at night).
|
||||
- RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).
|
||||
|
||||
## Decided by CC unattended (operator may reverse)
|
||||
|
||||
Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login
|
||||
instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes
|
||||
kept as patches, not commits, at night.
|
||||
@@ -0,0 +1,15 @@
|
||||
mirror main 6d5751db
|
||||
|
||||
26: repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
|
||||
|
||||
2026/10/27 21:56:30 sync.go:344: [WARN] [sync] git.repo_url changed (cache was cloned from https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git, config says file:///opt/docker/felhom-controller/dr
|
||||
2026/10/27 21:56:30 sync.go:318: [INFO] [sync] Cloning file:///opt/docker/felhom-controller/drill-catalog.git → /opt/docker/felhom-controller/data/catalog-cache
|
||||
2026/10/27 21:56:31 sync.go:511: [WARN] [sync] immich: catalog definition REFUSED by the allow-list — the app keeps its last good compose, nothing written: the catalog definition of immich asks for
|
||||
2026/10/27 21:56:31 sync.go:261: [INFO] [sync] catalog moved 540f18552bbf -> 6d5751dbdce2 (0 new, 0 stack dir(s) changed)
|
||||
2026/10/27 21:56:31 sync.go:299: [INFO] [sync] Catalog sync complete
|
||||
2026/10/27 21:56:31 sync.go:142: [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai nem változtak
|
||||
|
||||
expect n8n/docker-compose.yml ∋ N8N_DIAGNOSTICS_ENABLED=false: 1
|
||||
expect opengist/docker-compose.yml ∋ 256M: 2
|
||||
expect homepage/.felhom.yml ∋ family_gate: true: 1
|
||||
drill main 6d5751d, box cache 6d5751d: DRILL-CONFIRMED
|
||||
+219
@@ -0,0 +1,219 @@
|
||||
{
|
||||
"app": "home-assistant",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"to": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/home-assistant/home-assistant:2026.9.4@sha256:3e6710a7ab2a61311d9d899b719f6c3657791c63e8f4942cec4ebc42401d6b76"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4@sha256:3e6710a7ab2a61311d9d899b719f6c3657791c63e8f4942cec4ebc42401d6b76 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "9f2522e80bd1",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T22:00:02Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 7.2,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 8.2,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 113.9,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 125.2,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 135.5,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 135.5,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"catalog_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"home-assistant ghcr.io/home-assistant/home-assistant:2026.10.4 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"home-assistant": "sha256:23f4dfbb69ce76315dbc4de7915504f1c2dcecd7ca2648113a493a385972e133"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"installed": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"catalog": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"home-assistant": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 328122368,
|
||||
"limit_bytes": 1073741824,
|
||||
"anon_peak_pct": 30.6,
|
||||
"cgroup_peak_pct": 41.2,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-8a9bb18a5dd2eec74901443f9a0e65ea05d9ec8adc66fc0604ae443ae2af7905.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 30.6
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"22:57:43 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"22:59:44 [1] deployed, controller state=running, pinned={'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'}",
|
||||
"22:59:44 gate: ha is gated — passed as the household (cookie set)",
|
||||
"22:59:47 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"22:59:48 home-assistant: /api/onboarding/users http=200",
|
||||
"22:59:48 home-assistant: login as the seeded owner ok=True",
|
||||
"22:59:49 [5] drill commit 9f2522e80bd1: home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4 -> ghcr.io/home-assistant/home-assistant:2026.10.4 (push rc=0)",
|
||||
"22:59:58 [5] the box's drill mirror now at 9f2522e8",
|
||||
"23:00:03 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"23:00:03 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"23:00:10 + 7.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"23:00:11 + 8.2s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"23:01:57 + 113.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"23:02:08 + 125.2s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"23:02:18 + 135.5s phase=done label=Frissítve err=None hold=None",
|
||||
"23:02:38 home-assistant: login as the seeded owner ok=True",
|
||||
"23:02:38 [7] memory soak 600 s …",
|
||||
"23:12:44 [7] soak: peak 30.6% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
22:57:43 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:59:44 [1] deployed, controller state=running, pinned={'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'}
|
||||
22:59:44 gate: ha is gated — passed as the household (cookie set)
|
||||
22:59:47 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
22:59:48 home-assistant: /api/onboarding/users http=200
|
||||
22:59:48 home-assistant: login as the seeded owner ok=True
|
||||
22:59:49 [5] drill commit 9f2522e80bd1: home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4 -> ghcr.io/home-assistant/home-assistant:2026.10.4 (push rc=0)
|
||||
22:59:58 [5] the box's drill mirror now at 9f2522e8
|
||||
23:00:03 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
23:00:03 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
23:00:10 + 7.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
23:00:11 + 8.2s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
23:01:57 + 113.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
23:02:08 + 125.2s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
23:02:18 + 135.5s phase=done label=Frissítve err=None hold=None
|
||||
23:02:38 home-assistant: login as the seeded owner ok=True
|
||||
23:02:38 [7] memory soak 600 s …
|
||||
23:12:44 [7] soak: peak 30.6% of the limit (anon), kills 0, restarts 0
|
||||
23:12:44 [9] verdict proven -> /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/p2ev/home-assistant/verdict.json
|
||||
23:12:44 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
23:12:49 [X] stop -> 200 {'ok': True, 'message': 'Stack home-assistant stop completed'}
|
||||
23:13:21 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'home-assistant', 'volumes_removed': ['home-assistant_homeassistant_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [
|
||||
23:13:30 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP home-assistant: the superseded step {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'} keeps its definition at steps/4f987bb4b035eef9.yml
|
||||
STEP home-assistant: … and its .felhom.yml at steps/4f987bb4b035eef9.felhom.yml
|
||||
WROTE home-assistant: {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'} -> {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.10.4'} peak 30.6% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
@@ -0,0 +1,16 @@
|
||||
diff --git a/templates/wanderer/.felhom.yml b/templates/wanderer/.felhom.yml
|
||||
index e9582f8..ccb6a02 100644
|
||||
--- a/templates/wanderer/.felhom.yml
|
||||
+++ b/templates/wanderer/.felhom.yml
|
||||
@@ -12,6 +12,11 @@ slug: "wanderer"
|
||||
# changes an image: line must set this to the same day (see CLAUDE.md).
|
||||
catalog_since: "2026-07-21"
|
||||
|
||||
+# D59 (operator 2026-10-27 21:33, felhom.eu `09` §3 decision 275; R-1313): hidden until Wanderer's big step is done —
|
||||
+# v0.20.0 lets any ActivityPub server on the internet overwrite its records with no login. Hidden = not offered for new
|
||||
+# installs; an installed Wanderer keeps working in full (no box runs it on 2026-10-27). The big step un-hides it.
|
||||
+lifecycle: hidden
|
||||
+
|
||||
# --- Resource hints (displayed on deploy screen) ---
|
||||
resources:
|
||||
mem_request: "350M"
|
||||
@@ -0,0 +1,205 @@
|
||||
/mnt/5_hdd/felhom.eu/git/felhom.eu/scripts/security_watch.py:829: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datesecurity watch 2026-10-27: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key ABSENT — apps' advisories in a 2-night rotation
|
||||
ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
|
||||
ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY app codewithcj/sparkyfitness_server v0.17.3 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app fallenbagel/jellyseerr 2.7.3 CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app flomp/wanderer-db v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
|
||||
ADVISORY app flomp/wanderer-web v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY app ghcr.io/alexta69/metube 2026.09.29 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app ghcr.io/diced/zipline 4.8.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app ghcr.io/home-assistant/home-assistant 2026.9.4 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
|
||||
ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/lukegus/termix 2.8.0 GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 9 more
|
||||
ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
ADVISORY app ghcr.io/papra-hq/papra 26.6.2-rootless CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1)
|
||||
ADVISORY app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1); CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 GHSA-5f74-7rgh-pc97 (fixed a version after 2.6.15 (the notice names none)); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed a version after 2.6.15 (the notice names none)); … 7 more
|
||||
ADVISORY app ghost 6.67.0-alpine CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app gitea/gitea 1.27.3 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
|
||||
ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY app louislam/uptime-kuma 2.5.7 release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
ADVISORY app n8nio/n8n 2.44.7 GHSA-365g-vjw2-grx8 (fixed no fixed version named yet)
|
||||
ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
BEHIND app gotson/komga 1.28.0 newest 1.29.1
|
||||
BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP doop alpine/k8s 1.37.1
|
||||
GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
GAP doop bhgedigital/envsubst latest
|
||||
GAP doop busybox 1.38
|
||||
GAP doop codercom/code-server 4.143.1
|
||||
GAP buil debian 13.7-slim
|
||||
GAP buil debian 13.7-slim
|
||||
GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
GAP doop filebrowser/filebrowser v2.63.23
|
||||
GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
GAP doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
GAP doop griefed/serverpackcreator 8.1.2
|
||||
GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
GAP doop guacamole/guacamole 1.6.0
|
||||
GAP doop guacamole/guacd 1.6.0
|
||||
GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.2
|
||||
GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
GAP doop linuxserver/bookstack 26.09.20260929
|
||||
GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
GAP doop linuxserver/qbittorrent 5.3.0
|
||||
GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
GAP doop mariadb 11
|
||||
GAP doop mikefarah/yq 4.54.1
|
||||
GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
GAP doop msdeluise/plant-it-server 0.10.0
|
||||
GAP doop mysql 8.4
|
||||
GAP doop nicolaka/netshoot latest
|
||||
GAP doop postgis/postgis 16-3.5
|
||||
GAP doop postgres 15-alpine
|
||||
GAP doop postgres 16-alpine
|
||||
GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
GAP doop prom/alertmanager v0.34.1
|
||||
GAP doop prom/node-exporter v1.12.1
|
||||
GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
GAP doop python 3.15-bookworm
|
||||
GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
GAP doop renovate/renovate 44.181.1 newest 44.190.0
|
||||
GAP doop tailscale/tailscale v1.104.2
|
||||
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
|
||||
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.4 newest 11.8
|
||||
GAP app mariadb 11.8
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.8
|
||||
GAP app msdeluise/plant-it 0.10.0
|
||||
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP app postgis/postgis 16-3.5-alpine
|
||||
GAP app postgis/postgis 17-3.5-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 16-alpine
|
||||
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
FLOATING doop nginx 1.31-alpine
|
||||
FLOATING doop redis 8-alpine
|
||||
FLOATING doop redis 8.10-alpine
|
||||
FLOATING app ghcr.io/claperco/claper 2.5
|
||||
FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
FLOATING app jellyfin/jellyfin 12.4
|
||||
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
FLOATING app nzbgetcom/nzbget v26.3
|
||||
FLOATING app redis 7.4-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app wger/server 2.7
|
||||
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
CURRENT doop codewithcj/sparkyfitness v1.9.0
|
||||
CURRENT doop f0rc3/gokapi v2.2.4
|
||||
CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
CURRENT doop glanceapp/glance v0.8.7
|
||||
CURRENT buil golang 1.27.3-trixie
|
||||
CURRENT buil golang 1.27.3-alpine3.24
|
||||
CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
CURRENT buil restic 0.19.1
|
||||
CURRENT box traefik v3.7.16
|
||||
CURRENT doop vaultwarden/server 1.37.4
|
||||
CURRENT app codewithcj/sparkyfitness v0.17.3
|
||||
CURRENT app deluan/navidrome 0.64.2
|
||||
CURRENT app docmost/docmost 0.97.0
|
||||
CURRENT app f0rc3/gokapi v1.9.6
|
||||
CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
|
||||
CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
CURRENT app lscr.io/linuxserver/code-server 4.143.1
|
||||
CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
CURRENT app lukevella/rallly 4.16.3
|
||||
CURRENT app onlyoffice/documentserver 9.4.0
|
||||
CURRENT app outlinewiki/outline 1.12.0
|
||||
CURRENT app privatebin/pdo 2.1.0
|
||||
CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
CURRENT app vikunja/vikunja 2.7.1
|
||||
COUNTS ADVISORY=49 BEHIND=12 CURRENT=32 FLOATING=20 GAP=75 NOT_CHECKED=7 SELF=2
|
||||
REQUESTS api.github.com=49 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=64 hub.docker.com=225 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
MAIL (not sent, --no-mail): [Felhom security] termix, wanderer-db, wanderer-web, immich-machine-learning … — 58 new advisories
|
||||
MAIL (not sent, --no-mail): [Felhom security] the watch could not check runtime
|
||||
STATE wtime.datetime.now(datetime.UTC).
|
||||
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
ritten: /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/watch-state-fill2.json (292 known advisories)
|
||||
Reference in new issue
Block a user