From 28dadbe077e0e835901e11f261a2066a9ad12f9f Mon Sep 17 00:00:00 2001 From: Cindy Cicalese Date: Mon, 24 Aug 2026 08:14:19 -0400 Subject: [PATCH] Release CanastaBase 1.3.20 Bumps VERSION to 1.3.20 so the publish workflow builds and tags a new immutable image. Carries the two changes merged since 1.3.19: wiki directory cards resolve logos server-side, so a farm of private wikis shows them (#231); the image no longer patches MediaWiki's composer pins (#233). The rebuild picks up current Debian 12 packages through the APT_REFRESH cache-bust, clearing the fixable php8.2, libaprutil1 and python3-httplib2 findings against the 1.3.19 image (#229). CVE-2026-69246 in guzzlehttp/guzzle remains: 1.43.9 pins 7.12.3 and the bump to 7.15.2 landed on REL1_43 after the tag, so it clears when 1.43.10 ships. MediaWiki stays at 1.43.9, still the latest in the 1.43 series. --- RELEASE_NOTES.md | 1 + VERSION | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 3177b50..5f1ccbd 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -32,3 +32,4 @@ CanastaBase version history: - 1.3.17 - July 27, 2026 - Apt-layer cache-bust (#217); Debian security package refresh (#208); version-tag-only image rescan (#219) - 1.3.18 - July 27, 2026 - robots.txt User-agent line and load.php allow restored (#224); scan tracker per cycle (#222) - 1.3.19 - August 1, 2026 - /server-status served to loopback over IPv6; healthcheck addresses it numerically (#227) +- 1.3.20 - August 24, 2026 - Wiki directory logos on private wikis (#231); Debian security package refresh (#229); upstream composer pin patching removed (#233) diff --git a/VERSION b/VERSION index 4fc01ac..3c59b40 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.3.19 +1.3.20