REPORT — the nightly security watch (R-1303), 2026-10-26 night

A sibling of REPORT.md: the night session owns REPORT.md tonight. Readings taken alone (the brief's „safest reading", stated first):

The key: the operator said yes; the token did not exist by the end, so the watch runs in no-key mode (box programs nightly, apps' advisory lists every second night) and switches by itself when GH_ADVISORY_TOKEN exists. The name is GH_…, not GITHUB_…: Gitea reserves the GITHUB_ and GITEA_ prefixes for Actions secrets.

The memory: a file the CI job commits to main itself (documentation/security-watch/state.json), not the runner's disk (two runners, two disks), not the Actions cache (needs a node step), not DooPlex (a host change).

A seed that could not read everything (no key) leaves those pins pending; their first real read is recorded silently. Otherwise the first nights after the seed would have been the mail storm the brief forbids.

In plain words

Sources picked: GitHub's per-repo security advisories (the main source), GitHub release notes, the Cloudflare blog plus cloudflared's own VULN- notes, OSV for our Go builders, and the registries for „newer version". They cannot see: a fix told only by mail, forum or a blog we do not read; a security fix nobody calls one; packages inside our own images (Debian, Alpine, Samba); closed-source apps (Plex, Emby); floating tags like redis:7-alpine.
Watched: 108 pins — 11 box programs and build bases, 97 catalog images (21 of them with a stated „no source").
First real run (the seed, CI job 2408): ADVISORY on 30 pins (142 notices): 3 box programs (traefik, the file manager, cloudflared) and 27 apps; BEHIND on 17; 0 NOT CHECKED. Nothing was mailed — the seed records them.
The test mail arrived: yes — „[Felhom security] TEST — not a real advisory …" in the admin@felhom.eu mailbox (Resend id 01a17a5d-…, CI job 2407).
The operator does: make the GitHub key and store it as GH_ADVISORY_TOKEN (CC's store and Gitea Actions). Then decide the order of triage for the advisory list (R-1305, R-1306).

The ADVISORY list today (box programs first; full list `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`)

Program	Our version	Fixed in (notices)
traefik	v3.7.13	v3.7.14–v3.7.16 (15; triage: none seems to apply to our config — R-1304)
file manager (FileBrowser Quantum)	1.5.6-stable	1.5.7-stable for 2 of 36 (GHSA-qx86, needs the password; GHSA-3846); the rest on 2.x (R-1305)
cloudflared	2026.10.3	2026.10.4 (VULN-176088, metrics allowlist; our metrics are on the container's own loopback) + the eMudhra blog post (already fixed, R-1300)
27 apps	—	e.g. Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.2.4; Seerr 2.7.3 → 3.5.0; Wanderer v0.20.0 → v0.21.2; Rallly 4.15.3 → 4.15.4; Immich v3.2.4 → v3.3.5 (notes); SparkyFitness: no fix yet (R-1306)

Commits and CI (by commit)

Repo	Commit	What	CI
felhom.eu	`97ae7086`	spike + rows R-1303, R-1304	job 2401 success
felhom.eu	`1f62d629`	the watch, the shared list + gate, tests, workflow	job 2402 success
felhom.eu	`6ee23a3b`	abandoned = GAP; seed-pending	(see below)
app catalog	`f61800a`	`upstream:` in 65 templates, gate + decoys, checklist 1.10	job 2403 success
controller	`e01eb64b`	`upstream.txt`, `# upstream:` comments, gate + decoys	job 2404 success
felhom.eu	`ed843da7`	the memory, committed by the CI job itself	—
felhom.eu	(this commit)	docs, rows R-1305–R-1309, STATUS, this report	read at the end

Live runs in CI: job 2405 (dry: every host reached; 30 NOT CHECKED because DooPlex's shared GitHub quota was at 0 — printed and counted, the reason for the key), 2407 (test mail), 2408 (seed; memory pushed). Tests: 38 checks, no network; red-proved five ways (dedupe, streak, the 30-day window, a swallowed source error, the seed-pending set); the two gates' decoys red-proved with a reader that reads comments.

Rows

Before 215, after 222; opened 7 (R-1303 – R-1309), closed 0.

Observations

traefik v3.7.13 inside 12 October advisories — FILED: R-1304.
The file manager 1.5.6-stable inside 36 notices, 2 fixed in its own channel — FILED: R-1305.
27 app pins with published notices — FILED: R-1306 (one row; the list is the file).
Packages inside our own images not watched — FILED: R-1307. Floating tags — FILED: R-1308. Mail-only and silent fixes, closed-source apps — FILED: R-1309.
Three upstream repos renamed (cal.com → calcom/cal.diy, jellyseerr → seerr-team/seerr, wanderer → open-wanderer/wanderer) — NOT-A-FINDING: the mapping uses the new names; the images still pull.
plant-it's image name points nowhere — NOT-A-FINDING: known and stated in its template (abandoned); the watch lists it as GAP and never looks it up.
The hub's Dockerfile lines are not gated in felhom.eu's own runner (only the catalog's and the controller's are) — NOT-A-FINDING: the watch reads them nightly and reports a missing line as NOT CHECKED; a gate there would need its own decoy suite for two lines.
nginx's channel test treats 1.31 (mainline) as the same channel as 1.30 (stable) — NOT-A-FINDING: BEHIND is a weekly hint; the notice match does not depend on it.
Without a key, the dry run spent DooPlex's whole GitHub quota (shared with every DooPlex client) — NOT-A-FINDING: that is R-1303's „blocked on"; the watch reported it as NOT CHECKED, as designed.

Documents changed

runbooks/monthly-floating-retest.md §4a (the BEHIND check is nightly; the monthly run keeps the same-name re-test); architecture/capability-map-detail/B.md B23 (a watch mail starts the lane); architecture/08-alarm-ladder.md §11 (the three signals, [DESIGN]); scripts/CHANGELOG.md; REUSE.md; the catalog's NEW-APP-CHECKLIST.md 1.10. System poster: none of the three needed — no machine, path, backup tier or key changed (a CI job reads public sources).

Teardown

Machine and host: nothing provisioned. Hub: nothing. CI: three manual runs, no lasting change but the memory file. Work copies felhom.eu-cfsec, app-catalog-cfsec, felhom-controller-cfsec on DooPlex: removed at the end, all pushed.

6.4 KiB Raw Blame History Unescape Escape