admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a7e86fd2736c8bd3fa816cc2e827878be0cbdc8e
felhom.eu/documentation/audits/http2shell-2026-10-27/watch-fill-run.txt
T
admin f5a4995da5
gates / gates (push) Successful in 3m27s
Details
security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed 
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and
  layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io).
- security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images,
  filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step).
- dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d).
- Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved.
- audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log.
- 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
2026-10-27 23:23:02 +01:00

206 lines
24 KiB
Plaintext
Raw Blame History

/mnt/5_hdd/felhom.eu/git/felhom.eu/scripts/security_watch.py:829: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datesecurity watch 2026-10-27: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key ABSENT — apps' advisories in a 2-night rotation
ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 CVE-2026-111497 (fixed 24.22.1)
ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 CVE-2026-111497 (fixed 1.2.1)
ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY app codewithcj/sparkyfitness_server v0.17.3 CVE-2026-111497 (fixed 24.22.1)
ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
ADVISORY app fallenbagel/jellyseerr 2.7.3 CVE-2026-111497 (fixed 22.23.4)
ADVISORY app flomp/wanderer-db v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
ADVISORY app flomp/wanderer-web v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY app ghcr.io/alexta69/metube 2026.09.29 CVE-2026-111497 (fixed 1.2.1)
ADVISORY app ghcr.io/diced/zipline 4.8.0 CVE-2026-111497 (fixed 24.22.1)
ADVISORY app ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY app ghcr.io/home-assistant/home-assistant 2026.9.4 CVE-2026-111497 (fixed 1.2.1)
ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5); CVE-2026-111497 (fixed 24.22.1)
ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0); CVE-2026-111497 (fixed 24.22.1)
ADVISORY app ghcr.io/lukegus/termix 2.8.0 GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 9 more
ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
ADVISORY app ghcr.io/papra-hq/papra 26.6.2-rootless CVE-2026-111497 (fixed 26.12.1)
ADVISORY app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1)
ADVISORY app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1); CVE-2026-111497 (fixed 26.12.1)
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 GHSA-5f74-7rgh-pc97 (fixed a version after 2.6.15 (the notice names none)); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed a version after 2.6.15 (the notice names none)); … 7 more
ADVISORY app ghost 6.67.0-alpine CVE-2026-111497 (fixed 22.23.4)
ADVISORY app gitea/gitea 1.27.3 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
ADVISORY app louislam/uptime-kuma 2.5.7 release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
ADVISORY app n8nio/n8n 2.44.7 GHSA-365g-vjw2-grx8 (fixed no fixed version named yet)
ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
BEHIND app gotson/komga 1.28.0 newest 1.29.1
BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
GAP buil alpine 3.24.2 newest 3.24.3
GAP buil alpine 3.24.2 newest 3.24.3
GAP doop alpine/k8s 1.37.1
GAP doop arcadiatechnology/crafty-4 4.11.0
GAP doop bhgedigital/envsubst latest
GAP doop busybox 1.38
GAP doop codercom/code-server 4.143.1
GAP buil debian 13.7-slim
GAP buil debian 13.7-slim
GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
GAP doop docker.io/library/nextcloud 34.0.5-apache
GAP doop docker.io/valkey/valkey 9.2-alpine
GAP doop filebrowser/filebrowser v2.63.23
GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
GAP doop ghcr.io/onedr0p/exportarr v2.3.0
GAP doop ghcr.io/seerr-team/seerr v3.5.1
GAP doop ghcr.io/seriousm4x/upsnap 5
GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
GAP doop ghcr.io/tautulli/tautulli v2.18.2
GAP doop griefed/serverpackcreator 8.1.2
GAP doop gtstef/filebrowser 1.5.8-stable
GAP doop guacamole/guacamole 1.6.0
GAP doop guacamole/guacd 1.6.0
GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.2
GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
GAP doop linuxserver/bookstack 26.09.20260929
GAP doop linuxserver/prowlarr version-2.6.5.5623
GAP doop linuxserver/qbittorrent 5.3.0
GAP doop linuxserver/radarr version-6.4.4.10685
GAP doop linuxserver/sonarr version-4.0.20.3014
GAP doop mariadb 11
GAP doop mikefarah/yq 4.54.1
GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
GAP doop msdeluise/plant-it-server 0.10.0
GAP doop mysql 8.4
GAP doop nicolaka/netshoot latest
GAP doop postgis/postgis 16-3.5
GAP doop postgres 15-alpine
GAP doop postgres 16-alpine
GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
GAP doop prom/alertmanager v0.34.1
GAP doop prom/node-exporter v1.12.1
GAP doop prom/prometheus v3.15.0 newest v3.15.1
GAP doop prometheuscommunity/smartctl-exporter v0.15.0
GAP doop python 3.15-bookworm
GAP doop quay.io/jetstack/version-checker v0.11.0
GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
GAP doop renovate/renovate 44.181.1 newest 44.190.0
GAP doop tailscale/tailscale v1.104.2
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
GAP app mariadb 12.3
GAP app mariadb 11.4 newest 11.8
GAP app mariadb 11.8
GAP app mariadb 12.3
GAP app mariadb 11.8
GAP app msdeluise/plant-it 0.10.0
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
GAP app postgis/postgis 16-3.5-alpine
GAP app postgis/postgis 17-3.5-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 16-alpine
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
FLOATING doop nginx 1.31-alpine
FLOATING doop redis 8-alpine
FLOATING doop redis 8.10-alpine
FLOATING app ghcr.io/claperco/claper 2.5
FLOATING app ghcr.io/thomiceli/opengist 1.15
FLOATING app jellyfin/jellyfin 12.4
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
FLOATING app nzbgetcom/nzbget v26.3
FLOATING app redis 7.4-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app wger/server 2.7
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
CURRENT doop codewithcj/sparkyfitness v1.9.0
CURRENT doop f0rc3/gokapi v2.2.4
CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
CURRENT doop glanceapp/glance v0.8.7
CURRENT buil golang 1.27.3-trixie
CURRENT buil golang 1.27.3-alpine3.24
CURRENT doop onlyoffice/documentserver 9.4.0
CURRENT buil restic 0.19.1
CURRENT box traefik v3.7.16
CURRENT doop vaultwarden/server 1.37.4
CURRENT app codewithcj/sparkyfitness v0.17.3
CURRENT app deluan/navidrome 0.64.2
CURRENT app docmost/docmost 0.97.0
CURRENT app f0rc3/gokapi v1.9.6
CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
CURRENT app ghcr.io/cmintey/wishlist v0.69.0
CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
CURRENT app lscr.io/linuxserver/code-server 4.143.1
CURRENT app lscr.io/linuxserver/grocy 4.7.1
CURRENT app lscr.io/linuxserver/radarr 6.4.4
CURRENT app lscr.io/linuxserver/sonarr 4.0.20
CURRENT app lukevella/rallly 4.16.3
CURRENT app onlyoffice/documentserver 9.4.0
CURRENT app outlinewiki/outline 1.12.0
CURRENT app privatebin/pdo 2.1.0
CURRENT app vaultwarden/server 1.37.4-alpine
CURRENT app vikunja/vikunja 2.7.1
COUNTS ADVISORY=49 BEHIND=12 CURRENT=32 FLOATING=20 GAP=75 NOT_CHECKED=7 SELF=2
REQUESTS api.github.com=49 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=64 hub.docker.com=225 raw.githubusercontent.com=1 registry-1.docker.io=1
MAIL (not sent, --no-mail): [Felhom security] termix, wanderer-db, wanderer-web, immich-machine-learning … — 58 new advisories
MAIL (not sent, --no-mail): [Felhom security] the watch could not check runtime
STATE wtime.datetime.now(datetime.UTC).
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
ritten: /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/watch-state-fill2.json (292 known advisories)
Reference in new issue View Git Blame Copy Permalink