[jacobecox]

Work item 5376: the 10-22 Trivy scan of every template's latest version. Every fix is in one PR, so it is one merge (maintainer request 10-27).

Each template's branch is merged in unchanged (--no-ff, one merge commit per template), so its original commits and review diffs still apply. Each template lives in its own directory and no two branches touch the same file. Each original PR has been closed but keeps the full write-up: release-notes review, guard tables and test-round evidence. They are linked below.

How to review one template: git diff <copy-commit>..origin/jacob/5376-vulnerability-fixes -- <template>/versions/<new>/. The copy commit is the verbatim copy of the previous version, so this shows only the real change, per the two-commit rule.

The changes

Template	Version	Change	Copy commit	Was
keycloak	1.5.1	Keycloak 26.6.3 → 26.8.1: CVE-2026-18963 (Critical), unauthenticated account takeover	996e5ba4	#640
minio	1.4.0	MinIO images are no longer pullable (quay 401), so it runs Silo (pgsty/silo)	9e396400	#639
pgvector	1.0.1	pgvector 0.8.7: CVE-2026-103484	18b0e655	#646
nginx	1.1.3	nginx 1.31.7 (six advisories), a wizard, nginxConf as a value, Capacity AI removed	fdbcf8f9	#647
postgres-highly-available	2.8.1	patroni-postgres 0.8 (pgvector 0.8.7). Chart upgrades no longer refuse writes for ~2 min (HAProxy startup fix)	5b6a3bea	#674
postgres-multi-location	2.0.1	patroni-postgres 0.8, the same HAProxy fix, and the upgrade write-loss documented (fix tracked in #5396)	e05fab06	#665
timescaledb-highly-available	1.2.1	timescaledb-ha pg18.6-ts2.31.0 (pgvector 0.8.7), the same HAProxy fix, PgBouncer installs again	321a547e	#664
open-webui	1.4.0	Open WebUI v0.12.4. Trivy Critical/High 32/599 → 10/131	b7bef49d	#679
n8n	1.5.0	n8n 2.45.4 (vm2 sandbox escapes). Trivy 29/126 → 0/17. Exports N8N_WEBHOOK_URL	7c7349f4	#680
uptime-kuma	1.3.0	Uptime Kuma 2.5.8 (admin RCE, DoS). Trivy 103/1184 → 12/223. TCP-monitor caveat documented	683f4d62	#683
umami	1.5.0	Umami 3.4.1 (Next.js RCE). Trivy 7/48 → 0/5. Optional 2FA key	af6faefa	#684
ollama	1.2.0	Bundled Open WebUI v0.12.4 (Trivy 32/599 → 10/131). UI memory 1Gi → 2Gi (v0.12 at 1Gi intermittently fails API calls)	51179bdb	— (tested on its branch; report in the PR comment below)
langfuse	2.0.0	Langfuse 3.225.2 → 4.70.1 (Next.js RCE), ClickHouse 25.10 → 26.8. Trivy 6/49 → 0/3. A v3 → v4 migration path from 1.3.0 (langfuse.migration.writeMode / historicBackfill)	092cfa4b	— (tested on its branch; report in the PR comment below)

Common to every image bump:

• A {template}.validateImage render-time fail refuses the vulnerable tags. It is mirrored by a wizard rule, because the Console stores image in release values and a helm upgrade -f would otherwise keep the old tag.
• README and wizard upgrade notes for anything the user must do: back up first, because migrations are one-way.
• An updated briefing for each template.

pgvector in the 14 templates that bundle postgres-highly-available

Their bundled HA database ran controlplanecorporation/patroni-postgres:0.7 (pgvector 0.8.0, CVE-2026-103484). postgres-highly-available 2.8.1 is not published until this PR merges, so each template keeps its vendored subchart version and overrides the image to patroni-postgres:0.8 (maintainer decision 10-27). Each adds {svc}.validatePostgresHAImage (refuses tags 0.1–0.7 and an empty image when HA is on; the subchart's own default is still 0.7), mirrored by a wizard rule, plus a README "Upgrading from …" note (ALTER EXTENSION vector UPDATE; where the extension exists). HA is the default in chatwoot, glitchtip, grafana, metabase, unleash, temporal, keycloak and n8n; cdc-pipeline is HA-only; listmonk, nocodb, polaris, twenty and umami default to plain postgres:18 (no pgvector) and are affected only in HA mode. Only chatwoot creates vector itself.

Template	Version	Vendored pg-ha	Branch
chatwoot	1.3.1	2.5.0	jacob/chatwoot-1.3.1
glitchtip	1.4.1	2.5.0	jacob/glitchtip-1.4.1
grafana	1.5.1	2.5.0	jacob/grafana-1.5.1
metabase	1.5.1	2.5.0	jacob/metabase-1.5.1
listmonk	1.6.1	2.5.0	jacob/listmonk-1.6.1
nocodb	1.4.1	2.5.0	jacob/nocodb-1.4.1
polaris	1.3.1	2.5.0	jacob/polaris-1.3.1
twenty	1.4.1	2.5.0	jacob/twenty-1.4.1
unleash	1.5.1	2.5.0	jacob/unleash-1.5.1
temporal	2.1.1	2.7.0	jacob/temporal-2.1.1
cdc-pipeline	1.1.2	2.8.0	jacob/cdc-pipeline-1.1.2
keycloak	1.5.1 (also in the table above)	2.5.0	extra commits on jacob/keycloak-1.5.1
n8n	1.5.0 (also above)	2.5.0	extra commits on jacob/n8n-1.5.0
umami	1.5.0 (also above)	2.5.0	extra commits on jacob/umami-1.5.0

Live round per template (HA mode in every row): upgrade from the previous version with data created through the app → all three Patroni members on :0.8 / pgvector 0.8.7, data intact; the README ALTER EXTENSION step run verbatim; the guard refusing :0.7 and an empty image on the live release with nothing touched; a fresh install + drift-diff.py (no new drift: every field identical to the previous version, deferred per the 10-22 ruling) + two no-op upgrades; teardown with janitor clean ✓. All 14 PASS. HAProxy never restarts (helm may print Updated from a tag bump). The interruption is either the DB leader change (seconds) or, for single-replica stateful-style app tiers (chatwoot, n8n, listmonk, umami, nocodb, twenty), the app's own restart; each README says which.

E2E: all 14 onboarded to tests/ (none had a suite before), each run locally green in the round; this push is their first CI run. Each includes pgvector-0-8-7-available and every-patroni-member-on-0-8 (catches a partly rolled cluster).

Known platform issue, not filed (maintainer: being fixed): in 2 of ~16 HA rollouts one Patroni member stayed initializing with its volume unbound; a re-run passed.

Verification already done (per template, in its original PR)

• Live test round:
  • an upgrade from the previous version with real data created through the product;
  • a fresh install;
  • a live guard refusal;
  • two no-op upgrades;
  • teardown with janitor clean ✓.
• Console wizard round (on the test console) for keycloak, pgvector, nginx, postgres-highly-available, postgres-multi-location and timescaledb-highly-available.
• Combined branch: every new version renders (helm template) and tw lint gives 0 errors and 0 warnings. validate_catalog.py → 92 valid catalog entries … 0 with problems.

Console wizard rounds (test console, 10-28)

• Full rounds (install + upgrade from the previous version through the wizard, Preview = helm template, stored values = tw render/tw carry, teardown clean ✓): keycloak, pgvector, nginx, postgres-highly-available, postgres-multi-location, timescaledb-highly-available (earlier), and minio, open-webui, langfuse, ollama, umami, n8n. Findings fixed in this PR:
  • minio: the replica quota note was wrong (replicaDirect quota is 6, not 5); the 1.3.x → 1.4.0 outage warning moved to the Cluster step.
  • open-webui: the first-boot memory text; the upgrade note moved to the Sign-in step with the snapshot command and two upstream hazards.
  • langfuse: the pre-upgrade steps moved to the top of the step and onto Review; SDK versions now match the upstream v3→v4 guide; cut-over rules added.
  • ollama: the sign-out note; a rule for UI memory below 2Gi.
  • umami: a false 2FA lock-out warning on every 1.4.0 upgrade fixed with a migration; HA upgrade note added.
  • n8n: the downtime figure (~2 min); HA upgrade note added.
  • minio 1.3.1 → 1.4.0 upgrade could not be staged (1.3.1's image is unpullable); langfuse readiness needs a bucket the test console lacks (proven live in the test round).
• Light check (maintainer-approved scope for a one-field change): uptime-kuma and the 11 new bundling-template versions. tw lint/tw render/helm template pass, and in the console the refused image blocks Install and clears on the default.
• Console findings for the console team (non-blocking): Preview counts the CLI "Saving N charts" line as an item; Tab in a number field commits the highlighted suggestion.

CI: green on 3f1b44d3 (all 16 e2e suites). Fixes from the first runs: nocodb's sign-in check now waits out the post-upgrade restart; the postgres-highly-available pgvector check waits for the whole rollout. Drift warnings are the pre-existing probe fields, deferred (incl. langfuse minReadySeconds, maintainer 10-28).

Maintainer rulings (10-29)

• open-webui MCP sign-in HANDOFF: not needed, since 1.4.0 does not change the MCP integration.

• umami app.twoFactorKeySecretName: kept (tested end to end).

• langfuse migration.writeMode / historicBackfill: kept (tested end to end).

• langfuse backfill step 5: documented only, no knob.

• Drift (pre-existing probe fields, langfuse minReadySeconds): deferred.

• Seeds from the wizard PRs (pgvector 1.0.0: add wizard descriptor #626, postgres-multi-location 2.0.0: add wizard descriptor #629, timescaledb-highly-available 1.2.0: add wizard descriptor #628, uptime-kuma 1.2.0: add wizard descriptor #655, ollama 1.1.2: add wizard descriptor #657) all merged via Install wizards for the latest version of 36 templates (5362) #681 unchanged.

• Not in this PR:

  • the timescaledb pgvector README note (in place, on timescaledb 1.2.0: add wizard descriptor #623);
  • the timescaledb image bump: upstream pinned pgvector 0.8.7 on 10-24 but has pushed no image yet;
  • guacamole: no newer upstream than 1.6.0;
  • supabase (held, maintainer 10-27): no supabase/postgres tag ships pgvector 0.8.7 (all ≤ 0.8.2); the image refresh and probes of suspected 1.1.1 defects are a follow-up;
  • moving the 14 bundling templates to postgres-highly-available 2.8.1 itself (HAProxy start fix) after it publishes;
  • our own image rebuilds and the Node bumps.

• After merge: CHANGELOG entries go into changelog: PHP2Shell notice; credentials as secrets (5284 + follow-ups); 5376 vulnerability fixes; ghost, mysql, redis, neo4j, debezium-server, postgres-HA, cdc-pipeline, kafka, redis-cluster, searxng, nats #612; then the docs pages.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WZ5WWhTn9mEkPY7cLt1cr4

[github-actions]

@jacobecox template e2e tests failed, so this PR cannot merge yet. See the report above and the run logs.

[github-actions]

@jacobecox template e2e tests failed, so this PR cannot merge yet. See the report above and the run logs.