Update all services to latest stable versions#47
Merged
Conversation
Bump every service's images to the latest stable releases, apply the config migrations required by major upgrades, and sync all READMEs, docs and .env files to match. Notable major bumps & migrations: - GitLab 18.9.2 -> 19.1.0: switch DB to kkimurak/sameersbn-postgresql:17 (PG17 required), DB_EXTENSION pg_trgm,btree_gist, add required ActiveRecord encryption secrets. - Confluence 9.4.1 -> 10.2.13, Crowd 7.1.5 -> 7.2.1, Jira 11.3.3 -> 11.3.7 (Java 21 / UBI9). - Keycloak 26.5.5 -> 26.6.3: replace removed KC_PROXY with KC_PROXY_HEADERS. - Directus 11.16.1 -> 12.0.2: /server/ping healthcheck, IP_TRUST_PROXY, ACCEPT_TERMS. - n8n 2.12.3 -> 2.28.1: enable task runners. - Graylog 6.2 -> 6.3: explicit GRAYLOG_ELASTICSEARCH_HOSTS. - Weblate 5.16 -> 2026.6, Zabbix 7.2 -> 7.4 (MariaDB 12.2 compatible), SonarQube 26.3 -> 26.6, Metabase v0.59 -> v0.62, Sentry stack -> 26.6.0. - MySQL 8.0 (EOL) -> 8.4 LTS for mysql/directus/monica. Minor bumps: Vaultwarden 1.36.0, cloudflared 2026.6.1, dependency-track 4.14.2, nexus 3.93.1, registry 3.1.1, rundeck 5.20.1, tusd v2.10.0, traefik v3.7, duckling 0.2.0.2-r4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Warning Review limit reached
More reviews will be available in 42 minutes and 41 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughContainer image default tags are bumped across 25+ services (Bitwarden, Cloudflared, Confluence, Crowd, Dependency-Track, Directus, Duckling, Graylog, Jira, Keycloak, Metabase, Monica, MySQL, n8n, Nexus, Redash, Registry, Rundeck, Sentry, SonarQube, Traefik, TUS, Weblate, Zabbix). GitLab is upgraded to 19.1.0 with three new ActiveRecord encryption variables. Directus, Keycloak, Graylog, and n8n also receive non-trivial configuration additions alongside their version bumps. Documentation and ChangesService Version Bumps and Configuration Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@services/directus/docker-compose.yml`:
- Around line 21-22: The newly added Directus flags in the docker-compose
configuration are hardcoded literals instead of using compose-style environment
substitution. Update the Directus service entries for IP_TRUST_PROXY and
ACCEPT_TERMS to use ${VAR} defaults consistent with the existing docker-compose
policy, keeping the change localized to the service block in docker-compose.yml.
In `@services/gitlab/docker-compose.yml`:
- Line 4: The docker-compose image default variable name for the PostgreSQL
service is inconsistent with the required compose convention. Update the image
reference in the compose definition to use the service-version naming pattern
with POSTGRES_VERSION, and make sure any matching docs or env examples refer to
the same symbol so the contract stays consistent across stacks.
- Around line 60-62: Replace the predictable fallback defaults for the
ActiveRecord encryption settings in the docker-compose configuration with
required environment variable checks so startup fails when they are missing.
Update the three GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_* entries to use
required-variable syntax instead of default strings, keeping the change scoped
to the secrets block in docker-compose.yml.
In `@services/graylog/docker-compose.yml`:
- Line 48: The Graylog docker-compose service is hardcoding
GRAYLOG_ELASTICSEARCH_HOSTS instead of using the required environment
substitution style. Update the relevant docker-compose service definition to use
a defaulted ${VAR} expression for GRAYLOG_ELASTICSEARCH_HOSTS, keeping the value
configurable and consistent with the rest of the compose file.
In `@services/graylog/README.md`:
- Around line 83-84: The Elasticsearch image reference in the Graylog README is
inconsistent with the compose source registry, which can cause confusion when
pulling the image. Update the documentation entry for graylog-elasticsearch to
match the image used by the compose setup, and verify the README table stays
aligned with the source used by the Graylog compose configuration.
In `@services/keycloak/docker-compose.yml`:
- Line 15: The KC_PROXY_HEADERS value is hardcoded in the docker-compose service
config, so make it override-friendly by switching the Keycloak service’s
KC_PROXY_HEADERS entry to environment variable substitution using a ${VAR}
default. Update the docker-compose.yml setting for KC_PROXY_HEADERS to follow
the same pattern used by other configurable values in this file.
In `@services/n8n/docker-compose.yml`:
- Line 23: The N8N_RUNNERS_ENABLED setting in the docker-compose service is
hardcoded, so update the service environment block to use environment variable
substitution with a default value instead. Replace the literal value in the
docker-compose.yml entry for N8N_RUNNERS_ENABLED with a ${VAR} style reference
so it can be overridden consistently alongside the other compose variables.
In `@services/traefik-tunnel/README.md`:
- Line 84: The Traefik tunnel README has been updated to default TRAEFIK_VERSION
to v3.7, but the OCI naming documentation still advertises v3.6, so the docs are
out of sync. Update the TRAEFIK_VERSION entry in docs/OCI_NAMING.md to match the
new default and keep the versioning contract consistent across both docs, using
the same naming key to locate the table.
In `@services/zabbix/docker-compose.yml`:
- Line 29: The Zabbix service images are using a mutable `-latest` fallback,
which can change between pulls; update the image references in the
docker-compose service definitions to use explicit immutable patch tags instead
of `7.4-alpine-latest`. Apply the same change to both Zabbix image entries in
the compose file so deployments are reproducible, and keep the existing variable
pattern only if it resolves to a concrete pinned version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c5907598-d2fa-4eb9-a9a7-6de415d6f9d9
📒 Files selected for processing (48)
docs/DEPENDENCIES.mdservices/bitwarden/docker-compose.ymlservices/cloudflared/README.mdservices/cloudflared/docker-compose.ymlservices/confluence/docker-compose.ymlservices/crowd/docker-compose.ymlservices/dependency-track/docker-compose.ymlservices/directus/README.mdservices/directus/docker-compose.ymlservices/duckling/docker-compose.ymlservices/gitlab/.env.exampleservices/gitlab/README.mdservices/gitlab/docker-compose.ymlservices/graylog/README.mdservices/graylog/docker-compose.ymlservices/jira/README.mdservices/jira/docker-compose.ymlservices/keycloak/README.mdservices/keycloak/docker-compose.ymlservices/metabase/README.mdservices/metabase/docker-compose.ymlservices/monica/README.mdservices/monica/docker-compose.ymlservices/mysql/README.mdservices/mysql/docker-compose.ymlservices/n8n/README.mdservices/n8n/docker-compose.ymlservices/nexus/README.mdservices/nexus/docker-compose.ymlservices/redash/README.mdservices/registry/README.mdservices/registry/docker-compose.ymlservices/rundeck/README.mdservices/rundeck/docker-compose.ymlservices/sentry/.envservices/sentry/docker-compose.ymlservices/sonarqube/README.mdservices/sonarqube/docker-compose.ymlservices/traefik-tunnel/README.mdservices/traefik-tunnel/docker-compose.ymlservices/traefik/README.mdservices/traefik/docker-compose.ymlservices/tus/README.mdservices/tus/docker-compose.ymlservices/weblate/README.mdservices/weblate/docker-compose.ymlservices/zabbix/README.mdservices/zabbix/docker-compose.yml
- Directus/Graylog/Keycloak/n8n: parameterize newly added env vars with
${VAR:-default} substitution (IP_TRUST_PROXY, ACCEPT_TERMS,
GRAYLOG_ELASTICSEARCH_HOSTS, KC_PROXY_HEADERS, N8N_RUNNERS_ENABLED)
- Zabbix: pin immutable tag 7.4.11-alpine instead of mutable 7.4-alpine-latest
(server + web), sync README
- Graylog: align README Elasticsearch image with compose registry
(docker.elastic.co/elasticsearch/elasticsearch:7.17.29)
- Keycloak: fix stale README troubleshooting note (KC_PROXY=edge ->
KC_PROXY_HEADERS=xforwarded)
- docs/OCI_NAMING.md: bump Traefik example to v3.7
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings every service in the repo up to its latest stable image version, applies the config migrations required by major upgrades, and syncs all related files (compose defaults,
services/sentry/.env, service READMEs,docs/DEPENDENCIES.md, andservices/gitlab/.env.example).Every target tag was verified to exist in its registry (Docker Hub / quay.io / ghcr.io) before pinning, and all 34 compose files pass DCLint (0 errors) and the service-coverage check.
Major bumps & migrations (require attention)
18.9.2 → 19.1.0sameersbn/postgresql:15→kkimurak/sameersbn-postgresql:17(GitLab 19 requires PG17);DB_EXTENSION→pg_trgm,btree_gist; added required ActiveRecord encryption secrets (3 new vars, documented in.env.example+ README)9.4.1 → 10.2.13(UBI9/JDK21)7.1.5 → 7.2.111.3.3 → 11.3.726.5.5 → 26.6.3KC_PROXY: edgewithKC_PROXY_HEADERS: xforwarded(works with existingKC_HTTP_ENABLED)11.16.1 → 12.0.2/server/health→/server/ping(health is now auth-gated); addedIP_TRUST_PROXY=true(default flipped) andACCEPT_TERMS=true2.12.3 → 2.28.1N8N_RUNNERS_ENABLED=true(task runners)6.2 → 6.3GRAYLOG_ELASTICSEARCH_HOSTS(fixes default127.0.0.1lookup)5.16 → 2026.67.2 → 7.426.3 → 26.6v0.59.3.2 → v0.62.3.226.6.04.17_large_disk+ postgres14.23-bookworm, aligned to official self-hosted 26.6.0 (.envis authoritative)8.0 → 8.4 LTSdefault-authentication-pluginflags in use, so 8.4 is safeMinor / patch bumps
Vaultwarden
1.36.0, cloudflared2026.6.1, dependency-track4.14.2, nexus3.93.1-alpine, registry3.1.1, rundeck5.20.1, tusdv2.10.0, traefik + traefik-tunnelv3.7, duckling0.2.0.2-r4, elasticsearch (graylog)7.17.29.Left unchanged (intentional)
Internal/floating tags that are already current or have no newer stable:
beevelop/*(claude-code, shields/varnish), huginn (latest), openvpn (latest, unmaintained), minio, phpmyadmin5.2.3, statpingv0.90.78, cabot0.11.16(+ its rabbitmq 3.13 / pg17), monica5.0.0-beta.5-apache. Redash stays26.3.0(latest stable; newer ispreviewonly).Validation
dclint services -r -c .dclintrc.yaml): 0 errors (1 pre-existing port-order warning in traefik, non-blocking)./.github/scripts/check-service-coverage.sh: PASSED (34/34)test-servicesboot matrix runs in CI (no Docker daemon available locally)Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
Summary by CodeRabbit