jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(deps): patch updates: Forgejo 16.0.6, Vaultwarden 1.37.4, Headscale 0.29.5, Authelia 4.39.28, CrowdSec 1.8.1 #103

Merged
jfraeys merged 1 commit from jfraeys/chore/deps-patch-batch-1 into main 2026-10-13 14:31:13 -04:00
Conversation 0 Commits 1 Files changed 7 +11 -11
jfraeys commented 2026-10-13 12:30:02 -04:00
Owner
Copy link

Batch 1 of the version survey (all same minor line; the tags exist upstream: checked on Docker Hub and the codeberg.org registry).

Component From To Why
Vaultwarden 1.37.1 1.37.4 Security: High advisory (organization member revocation, GHSA-69q9-v8p6-xvx3) and two Medium (2FA, org invitations) fixed in 1.37.4; 2FA remember-token revocation and prelogin rate limiting in 1.37.3; 1.37.2 is required for clients 2026.8.0+
Headscale 0.29.2 0.29.5 fixes: SSH access surviving removal of its policy rules, removed peers staying listed
Forgejo 16.0.3 16.0.6 three patch releases (release notes carry no text; patch line of 16.0)
Authelia 4.39.2 4.39.28 patch line of 4.39
CrowdSec v1.8.0 v1.8.1 patch

Validation. Role pins are under roles/, a staging trigger path, so merging starts a full fresh-install staging run, and the promotion gate will not deploy a commit staging has not validated. That proves the new images start, integrate and pass the connectivity, port and hardening checks. It does NOT prove an in-place upgrade of existing data (database migrations run when the new image starts against the old data), so before deploying to production:

  1. take a backup first (restic via the backups role) and note the snapshot id;
  2. deploy one service at a time with its tag: scripts/deploy-services.sh --tags <vaultwarden|forgejo|headscale|authelia|crowdsec> --limit services (gated by the promotion check), starting with Vaultwarden (security fix);
  3. check the service's health and scripts/check-exposure.py;
  4. rollback = revert the pin and redeploy; if the new version already migrated the database, restore the snapshot instead.

Not in this PR: OpenTofu 1.12.7 (CVE fixes; its own PR because the provisioner roles are skipped in staging), the runner 13.0.0 to 13.2.0, and the minor bumps (Anubis, node-exporter, cAdvisor 0.49 to 0.60). Local checks: yamllint, check-downloads hygiene, services.yml syntax-check; no leftover old pins (git grep).

🤖 Generated with Claude Code

Batch 1 of the version survey (all same minor line; the tags exist upstream: checked on Docker Hub and the codeberg.org registry). | Component | From | To | Why | |---|---|---|---| | Vaultwarden | 1.37.1 | 1.37.4 | **Security**: High advisory (organization member revocation, GHSA-69q9-v8p6-xvx3) and two Medium (2FA, org invitations) fixed in 1.37.4; 2FA remember-token revocation and prelogin rate limiting in 1.37.3; 1.37.2 is required for clients 2026.8.0+ | | Headscale | 0.29.2 | 0.29.5 | fixes: SSH access surviving removal of its policy rules, removed peers staying listed | | Forgejo | 16.0.3 | 16.0.6 | three patch releases (release notes carry no text; patch line of 16.0) | | Authelia | 4.39.2 | 4.39.28 | patch line of 4.39 | | CrowdSec | v1.8.0 | v1.8.1 | patch | Validation. Role pins are under roles/, a staging trigger path, so merging starts a full fresh-install staging run, and the promotion gate will not deploy a commit staging has not validated. That proves the new images start, integrate and pass the connectivity, port and hardening checks. It does NOT prove an in-place upgrade of existing data (database migrations run when the new image starts against the old data), so before deploying to production: 1. take a backup first (restic via the backups role) and note the snapshot id; 2. deploy one service at a time with its tag: `scripts/deploy-services.sh --tags <vaultwarden|forgejo|headscale|authelia|crowdsec> --limit services` (gated by the promotion check), starting with Vaultwarden (security fix); 3. check the service's health and `scripts/check-exposure.py`; 4. rollback = revert the pin and redeploy; if the new version already migrated the database, restore the snapshot instead. Not in this PR: OpenTofu 1.12.7 (CVE fixes; its own PR because the provisioner roles are skipped in staging), the runner 13.0.0 to 13.2.0, and the minor bumps (Anubis, node-exporter, cAdvisor 0.49 to 0.60). Local checks: yamllint, check-downloads hygiene, services.yml syntax-check; no leftover old pins (git grep). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore(deps): patch updates: Forgejo 16.0.6, Vaultwarden 1.37.4, Headscale 0.29.5, Authelia 4.39.28, CrowdSec 1.8.1
All checks were successful
Lint / lint (pull_request) Successful in 1m35s
Details
Secret scan / scan (pull_request) Successful in 13s
Details
6dc380d177
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!103
No description provided.