54 lines
3.1 KiB
Markdown
54 lines
3.1 KiB
Markdown
# REPORT — security app updates, 2026-10-27 (day, attended)
|
||
|
||
> A sibling of `REPORT.md` (the release session of the same day owns that file).
|
||
|
||
## In plain words
|
||
|
||
- **Real notices:** the security watch flagged 38 pins. Read by hand: 33 real, in 32 apps plus 3 box programs; 5 apps
|
||
were false alarms (`audits/security-app-updates-2026-10-27/TRIAGE.md`).
|
||
- **Out tonight by the quick lane:** 14 apps, in three batches, each on your yes — Rallly, RomM, code-server, Outline,
|
||
Vikunja; n8n, PrivateBin, Docmost, Grafana; Homebox, Mealie, Audiobookshelf, BentoPDF, Uptime Kuma. Wishlist and
|
||
Bookstack had no notice id and went as normal steps. Immich (the lowest item) was not done.
|
||
- **Big steps:** Jellyfin 10.11 → 12.4 is done (bench, box, and the undo proven). Ten are left, a row each.
|
||
- **No-fix picks:** four questions for you (STATUS D56–D59); none changed a template.
|
||
- **Box programs released:** yes — controller 0.346.1 (Traefik v3.7.16, file manager 1.5.8-stable, cloudflared
|
||
2026.10.4), global floor 15:50:15Z on your yes.
|
||
|
||
## Catalog commits (app-catalog-felhom.eu) and CI by commit
|
||
|
||
| Commit | What | CI job |
|
||
|---|---|---|
|
||
| `06e603e` | batch 1 + wishlist; Rallly/Jellyfin fixtures; the privileges gate skips `steps/*.felhom.yml` | 2422 success |
|
||
| `7b0071e` | batch 2 + bookstack | 2425 success |
|
||
| `65a6b11` | batch 3; Homebox/Mealie fixtures | 2432 (see the final report for the read-back) |
|
||
| `540f185` | Jellyfin 10.11.11 → 12.4 | (see the final report) |
|
||
|
||
## Controller
|
||
|
||
`v0.346.1` = the release commit `b1b9be3` (v0.346.0) + one commit `5ba1b86` (tag `v0.346.1`; the same commit is on
|
||
`main`). CI 2427/2428 success. Image `gitea.dooplex.hu/admin/felhom-controller:0.346.1`
|
||
`sha256:b6b1e5488d31cb0b6596228fd6bf50900692ab0798d5da858159db67e8440190`, built from `ed3927f` (= `5ba1b86` + the
|
||
release session's REPORT.md only). MinAgent 0.158.1.
|
||
|
||
## Proofs
|
||
|
||
- The lane: a negative control first (busybox as TO → `failed`, undone). 14 walks `proven`, 12 with the seed read back.
|
||
- Part 5: 9202 (rc.1) and Tester 1, demo-hp, demo-felhom (per-box floors 15:41Z): all 29 public names redirect to
|
||
https; the file manager signs in (Tester 1, 9202: listing 200, 401 without a cookie); an app container cannot reach
|
||
it on any box (R-1281 probe with a control); the tunnel gap 4–5 s per box, the Traefik restart 7–20 s; a 30-minute
|
||
watch after the global floor was clean; the per-box floors cleared.
|
||
- Part 3: Jellyfin's undo — 12.4 migrated the database, failed on purpose, the box undid it, 10.11 signed the user in.
|
||
|
||
## Register
|
||
|
||
Rows at the task's start 221; now 224. This task opened 15 (R-1310, R-1311, R-1313–R-1325, R-1314 closed the same day)
|
||
and closed 3 (R-1304, R-1306, R-1314); R-1305 NARROWED. The release session closed ten and opened one in the same time.
|
||
|
||
## Teardown
|
||
|
||
Machine: 9202 back on the live catalog, controller 0.346.1, its saved config copy removed (identical); the walks
|
||
removed every app they installed; the drill mirror in 9202's volume stays (harmless, as after B23). Bench 9401
|
||
stopped (as found). Host: nothing. Hub: per-box floors cleared; the global floor 0.346.1 stays (intended).
|
||
|
||
Evidence: `documentation/audits/security-app-updates-2026-10-27/`.
|