REPORT — security app updates, 2026-10-27 (day, attended)

A sibling of REPORT.md (the release session of the same day owns that file).

In plain words

Real notices: the security watch flagged 38 pins. Read by hand: 33 real, in 32 apps plus 3 box programs; 5 apps were false alarms (audits/security-app-updates-2026-10-27/TRIAGE.md).
Out tonight by the quick lane: 14 apps, in three batches, each on your yes — Rallly, RomM, code-server, Outline, Vikunja; n8n, PrivateBin, Docmost, Grafana; Homebox, Mealie, Audiobookshelf, BentoPDF, Uptime Kuma. Wishlist and Bookstack had no notice id and went as normal steps. Immich (the lowest item) was not done.
Big steps: Jellyfin 10.11 → 12.4 is done (bench, box, and the undo proven). Ten are left, a row each.
No-fix picks: four questions for you (STATUS D56–D59); none changed a template.
Box programs released: yes — controller 0.346.1 (Traefik v3.7.16, file manager 1.5.8-stable, cloudflared 2026.10.4), global floor 15:50:15Z on your yes.

Catalog commits (app-catalog-felhom.eu) and CI by commit

Commit	What	CI job
`06e603e`	batch 1 + wishlist; Rallly/Jellyfin fixtures; the privileges gate skips `steps/*.felhom.yml`	2422 success
`7b0071e`	batch 2 + bookstack	2425 success
`65a6b11`	batch 3; Homebox/Mealie fixtures	2432 (see the final report for the read-back)
`540f185`	Jellyfin 10.11.11 → 12.4	(see the final report)

Controller

v0.346.1 = the release commit b1b9be3 (v0.346.0) + one commit 5ba1b86 (tag v0.346.1; the same commit is on main). CI 2427/2428 success. Image gitea.dooplex.hu/admin/felhom-controller:0.346.1 sha256:b6b1e5488d31cb0b6596228fd6bf50900692ab0798d5da858159db67e8440190, built from ed3927f (= 5ba1b86 + the release session's REPORT.md only). MinAgent 0.158.1.

Proofs

The lane: a negative control first (busybox as TO → failed, undone). 14 walks proven, 12 with the seed read back.
Part 5: 9202 (rc.1) and Tester 1, demo-hp, demo-felhom (per-box floors 15:41Z): all 29 public names redirect to https; the file manager signs in (Tester 1, 9202: listing 200, 401 without a cookie); an app container cannot reach it on any box (R-1281 probe with a control); the tunnel gap 4–5 s per box, the Traefik restart 7–20 s; a 30-minute watch after the global floor was clean; the per-box floors cleared.
Part 3: Jellyfin's undo — 12.4 migrated the database, failed on purpose, the box undid it, 10.11 signed the user in.

Register

Rows at the task's start 221; now 224. This task opened 15 (R-1310, R-1311, R-1313–R-1325, R-1314 closed the same day) and closed 3 (R-1304, R-1306, R-1314); R-1305 NARROWED. The release session closed ten and opened one in the same time.

Teardown

Machine: 9202 back on the live catalog, controller 0.346.1, its saved config copy removed (identical); the walks removed every app they installed; the drill mirror in 9202's volume stays (harmless, as after B23). Bench 9401 stopped (as found). Host: nothing. Hub: per-box floors cleared; the global floor 0.346.1 stays (intended).

Evidence: documentation/audits/security-app-updates-2026-10-27/.

3.1 KiB Raw Blame History Unescape Escape