Release CanastaBase 1.3.20 - #234
Merged
Merged
Conversation
Bumps VERSION to 1.3.20 so the publish workflow builds and tags a new immutable image. Carries the two changes merged since 1.3.19: wiki directory cards resolve logos server-side, so a farm of private wikis shows them (#231); the image no longer patches MediaWiki's composer pins (#233). The rebuild picks up current Debian 12 packages through the APT_REFRESH cache-bust, clearing the fixable php8.2, libaprutil1 and python3-httplib2 findings against the 1.3.19 image (#229). CVE-2026-69246 in guzzlehttp/guzzle remains: 1.43.9 pins 7.12.3 and the bump to 7.15.2 landed on REL1_43 after the tag, so it clears when 1.43.10 ships. MediaWiki stays at 1.43.9, still the latest in the 1.43 series.
|
🐳 The image based on 28dadbe0 commit has been built with |
yaronkoren
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
VERSIONto 1.3.20, publishing a new immutable image.Carries the two changes merged since 1.3.19:
<img>per card and resolved its source from the browser via ameta=siteinfoquery. That request carries no session, so a wiki with$wgGroupPermissions['*']['read'] = falseansweredreadapideniedand the card stayed logo-less. The logo is now resolved while the page renders, frompublic_assets/<id>/logo.<ext>, which is reachable regardless of the wiki's read permissions.monolog/monologpin, a step that had matched nothing since the image moved to 1.43 and reported success anyway. The image now builds MediaWiki as upstream released it; dependency versions belong to the release selected byMW_CORE_VERSION.Security
The rebuild picks up current Debian 12 packages through the
APT_REFRESHcache-bust, clearing the fixablephp8.2(CVE-2026-17543),libaprutil1(CVE-2026-34191) andpython3-httplib2(CVE-2026-59939) findings reported against the 1.3.19 image.CVE-2026-69246 in
guzzlehttp/guzzleis not cleared by this release. MediaWiki 1.43.9 pins7.12.3exactly, and the bump to7.15.2landed onREL1_43after the tag was cut, so it resolves when 1.43.10 ships. Patching the pin in the image is out of scope per #232.MediaWiki stays at 1.43.9, still the latest in the 1.43 series.
Closes #235.
Refs #229