chore: upgrade to 3.1.0+2.4.0 #13

notplants · 2026-06-09T01:19:48Z

notplants commented

2026-06-09 01:19:48 +00:00

@stevensting ty for you maintenance of this recipe!

autonomic was doing some scanning recipes we use for CVE, and saw that this recipe needed a version bump to address a CVE so just popped over here to create the PR, if you get a chance to take a look

@stevensting ty for you maintenance of this recipe! autonomic was doing some scanning recipes we use for CVE, and saw that this recipe needed a version bump to address a CVE so just popped over here to create the PR, if you get a chance to take a look

notplants added 1 commit 2026-06-09 01:19:50 +00:00

chore: upgrade to 3.1.0+2.4.0 a276812819

notplants force-pushed upgrade-3.1.0+2.4.0 from a276812819 to eb4521cc5d

2026-06-09 01:26:30 +00:00

Compare

stevensting commented

2026-06-09 09:09:36 +00:00

@stevensting ty for you maintenance of this recipe!

autonomic was doing some scanning recipes we use for CVE, and saw that this recipe needed a version bump to address a CVE so just popped over here to create the PR, if you get a chance to take a look

Hi, thanks for the heads up. Any particular reason why you created this pull request instead of using the two renovate PRs?
I just merged the two PRs, did the release and tested it. I will close this PR. Happy upgrading.

> @stevensting ty for you maintenance of this recipe! > > autonomic was doing some scanning recipes we use for CVE, and saw that this recipe needed a version bump to address a CVE so just popped over here to create the PR, if you get a chance to take a look > Hi, thanks for the heads up. Any particular reason why you created this pull request instead of using the two renovate PRs? I just merged the two PRs, did the release and tested it. I will close this PR. Happy upgrading.

stevensting closed this pull request

2026-06-09 09:09:36 +00:00

stevensting commented

2026-06-09 11:23:50 +00:00

@notplants could you tell me which CVE that was?

notplants commented

2026-06-09 14:22:33 +00:00

thank you @stevensting . the security issue was mentioned here in the release notes https://github.com/louislam/uptime-kuma/releases/tag/2.4.0 although they have not disclosed exactly what it was yet (I think it was probably this one in liquidjs: https://orca.security/resources/blog/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts/)

and I had no reason to create the PR instead of use renovate. we were just checking through recipes we used in a systematic way, but glad to hear you have a nice flow with renovate

thank you @stevensting . the security issue was mentioned here in the release notes https://github.com/louislam/uptime-kuma/releases/tag/2.4.0 although they have not disclosed exactly what it was yet (I think it was probably this one in liquidjs: https://orca.security/resources/blog/critical-rce-in-liquidjs-lets-attackers-execute-arbitrary-commands-on-unpatched-hosts/) and I had no reason to create the PR instead of use renovate. we were just checking through recipes we used in a systematic way, but glad to hear you have a nice flow with renovate

notplants commented

2026-06-09 14:26:43 +00:00

@stevensting the one difference I see is I added MARIADB_AUTO_UPGRADE=1 (https://hub.docker.com/_/mariadb#mariadb_auto_upgrade) which I thought might have been required for major version bumps of mariadb to work automatically?

but you tested the migration and the db was updated automatically even without that?

@stevensting the one difference I see is I added MARIADB_AUTO_UPGRADE=1 (https://hub.docker.com/_/mariadb#mariadb_auto_upgrade) which I thought might have been required for major version bumps of mariadb to work automatically? but you tested the migration and the db was updated automatically even without that?

stevensting commented

2026-06-09 17:16:36 +00:00

@stevensting the one difference I see is I added MARIADB_AUTO_UPGRADE=1 (https://hub.docker.com/_/mariadb#mariadb_auto_upgrade) which I thought might have been required for major version bumps of mariadb to work automatically?

but you tested the migration and the db was updated automatically even without that?

@notplants hmm, good point. Yes, everything worked fine without a manual step. the DB got upgraded and mariadb-check gives no errors.
But maybe I should nevertheless put the auto upgrade flag in there for the next upgrade

> @stevensting the one difference I see is I added MARIADB_AUTO_UPGRADE=1 (https://hub.docker.com/_/mariadb#mariadb_auto_upgrade) which I thought might have been required for major version bumps of mariadb to work automatically? > > but you tested the migration and the db was updated automatically even without that? @notplants hmm, good point. Yes, everything worked fine without a manual step. the DB got upgraded and mariadb-check gives no errors. But maybe I should nevertheless put the auto upgrade flag in there for the next upgrade

notplants commented

2026-06-09 19:19:45 +00:00

thats a headscratcher... I wonder why they have the flag if its not actually necessary... but yes seems safer to include it than not haha

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/uptime-kuma#13