Update all services to latest stable versions

docs/DEPENDENCIES.md

@@ -33,11 +33,11 @@ This document maps dependencies between BeeCompose services and their backing st
 | cabot | postgres | 17-alpine |
 | confluence | postgresql | 17-alpine |
 | crowd | postgresql | 17-alpine |
-| gitlab | database | sameersbn/postgresql:15-20230628 |
+| gitlab | database | kkimurak/sameersbn-postgresql:17 |
 | huginn | postgres | 17-alpine |
 | jira | postgresql | 17-alpine |
 | keycloak | postgres | 17 |
-| metabase | database | 17-alpine |
+| metabase | database | 15-alpine |
 | redash | postgres | 17-alpine |
 | sentry | postgres | 17-alpine |
 | sonarqube | database | 17-alpine |
@@ -48,11 +48,11 @@ This document maps dependencies between BeeCompose services and their backing st
 
 | Service | Container Name | Version |
 |---------|---------------|---------|
-| directus | mysql | 8.0 |
-| monica | mysql | 8.0 |
-| mysql | mysql | 8.0 |
+| directus | mysql | 8.4 |
+| monica | mysql | 8.4 |
+| mysql | mysql | 8.4 |
 | rundeck | (embedded) | - |
-| zabbix | database | mariadb:11.7 |
+| zabbix | database | mariadb:12.2 |
 
 ### Redis Services
 
@@ -69,7 +69,7 @@ This document maps dependencies between BeeCompose services and their backing st
 | Service | Database | Container Name | Version |
 |---------|----------|---------------|---------|
 | graylog | MongoDB | mongodb | 8.0 |
-| graylog | Elasticsearch | elasticsearch | 7.17.27 |
+| graylog | Elasticsearch | elasticsearch | 7.17.29 |
 
 ### Cache Services
 

docs/OCI_NAMING.md

@@ -35,7 +35,7 @@ Versions are extracted from the service's `.env` file, specifically from the fir
 | Service | `.env` Variable | OCI Tag |
 |---------|-----------------|---------|
 | GitLab | `GITLAB_VERSION=18.8.0` | `ghcr.io/beevelop/gitlab:v18.8.0` |
-| Traefik | `TRAEFIK_VERSION=v3.6` | `ghcr.io/beevelop/traefik:v3.6` |
+| Traefik | `TRAEFIK_VERSION=v3.7` | `ghcr.io/beevelop/traefik:v3.7` |
 | Metabase | `METABASE_VERSION=v0.58.2` | `ghcr.io/beevelop/metabase:v0.58.2` |
 
 ## Versioning Rules

services/bitwarden/docker-compose.yml

@@ -1,7 +1,7 @@
 name: bitwarden
 services:
   bitwarden:
-    image: vaultwarden/server:${VAULTWARDEN_VERSION:-1.35.4}
+    image: vaultwarden/server:${VAULTWARDEN_VERSION:-1.36.0}
     container_name: bitwarden
     volumes:
       - bitwarden_data:/data/

services/cloudflared/README.md

@@ -144,7 +144,7 @@ docker compose -f docker-compose.yml -f docker-compose.tunnel.yml up -d
 | Variable | Description | Default |
 |----------|-------------|---------|
 | `COMPOSE_PROJECT_NAME` | Docker Compose project name | `cloudflared` |
-| `CLOUDFLARED_VERSION` | cloudflared image version | `2025.1.0` |
+| `CLOUDFLARED_VERSION` | cloudflared image version | `2026.6.1` |
 
 ## Deployment Modes
 

services/cloudflared/docker-compose.yml

@@ -2,7 +2,7 @@ name: cloudflared
 services:
 
   cloudflared:
-    image: cloudflare/cloudflared:${CLOUDFLARED_VERSION:-2026.3.0}
+    image: cloudflare/cloudflared:${CLOUDFLARED_VERSION:-2026.6.1}
     container_name: cloudflared
     environment:
       - TUNNEL_TOKEN=${CF_TUNNEL_TOKEN}

services/confluence/docker-compose.yml

@@ -1,7 +1,7 @@
 name: confluence
 services:
   confluence:
-    image: atlassian/confluence:${CONFLUENCE_VERSION:-9.4.1-ubi9-jdk21}
+    image: atlassian/confluence:${CONFLUENCE_VERSION:-10.2.13-ubi9-jdk21}
     container_name: confluence
     depends_on:
       - postgresql

services/crowd/docker-compose.yml

@@ -1,7 +1,7 @@
 name: crowd
 services:
   crowd:
-    image: atlassian/crowd:${CROWD_VERSION:-7.1.5-ubi9-jdk21}
+    image: atlassian/crowd:${CROWD_VERSION:-7.2.1-ubi9-jdk21}
     container_name: crowd
     depends_on:
       - postgresql

services/dependency-track/docker-compose.yml

@@ -1,7 +1,7 @@
 name: dependency-track
 services:
   dtrack:
-    image: dependencytrack/bundled:${DEPENDENCY_TRACK_VERSION:-4.14.0}
+    image: dependencytrack/bundled:${DEPENDENCY_TRACK_VERSION:-4.14.2}
     container_name: dtrack
     volumes:
       - dtrack_data:/data

services/directus/README.md

@@ -72,8 +72,8 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 
 | Container | Image | Purpose |
 |-----------|-------|---------|
-| directus | directus/directus:11.14.1 | Headless CMS / Data Platform |
-| directus-mysql | mysql:8.0 | MySQL database backend |
+| directus | directus/directus:12.0.2 | Headless CMS / Data Platform |
+| directus-mysql | mysql:8.4 | MySQL database backend |
 
 ## Environment Variables
 

services/directus/docker-compose.yml

@@ -1,7 +1,7 @@
 name: directus
 services:
   directus:
-    image: directus/directus:${DIRECTUS_VERSION:-11.16.1}
+    image: directus/directus:${DIRECTUS_VERSION:-12.0.2}
     container_name: directus
     depends_on:
       - mysql
@@ -18,12 +18,14 @@ services:
       DB_USER: ${DB_USER:-directus}
       DB_PASSWORD: ${DB_PASS:-Swordfish}
       PUBLIC_URL: https://${SERVICE_DOMAIN:-example.com}
+      IP_TRUST_PROXY: ${IP_TRUST_PROXY:-true}
+      ACCEPT_TERMS: ${ACCEPT_TERMS:-true}
     networks:
       - directus
       - traefik
     restart: unless-stopped
     healthcheck:
-      test: [ "CMD", "wget", "-q", "--spider", "http://localhost:8055/server/health" ]
+      test: [ "CMD", "wget", "-q", "--spider", "http://localhost:8055/server/ping" ]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -41,7 +43,7 @@ services:
       - "traefik.docker.network=traefik_default"
 
   mysql:
-    image: mysql:${MYSQL_TAG:-8.0}
+    image: mysql:${MYSQL_TAG:-8.4}
     container_name: directus-mysql
     volumes:
       - mysql_data:/var/lib/mysql

services/duckling/docker-compose.yml

@@ -1,7 +1,7 @@
 name: duckling
 services:
   duckling:
-    image: rasa/duckling:${DUCKLING_VERSION:-0.2.0.2-r3}
+    image: rasa/duckling:${DUCKLING_VERSION:-0.2.0.2-r4}
     container_name: duckling
     networks:
       - traefik

services/gitlab/.env.example

@@ -19,6 +19,13 @@ GITLAB_SECRETS_DB_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef12345
 GITLAB_SECRETS_SECRET_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 GITLAB_SECRETS_OTP_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 
+# ActiveRecord encryption secrets (required since GitLab 17 / mandatory for GitLab 19)
+# PRIMARY_KEY and DETERMINISTIC_KEY must be JSON arrays of strings; SALT is a plain string.
+# Generate each value with: openssl rand -hex 16
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=["1234567890abcdef1234567890abcdef"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=["abcdef1234567890abcdef1234567890"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=fedcba0987654321fedcba0987654321
+
 # GitLab settings
 GITLAB_TIMEZONE=Berlin
 GITLAB_EMAIL=gitlab@example.com

services/gitlab/README.md

@@ -22,6 +22,9 @@ GITLAB_ROOT_PASSWORD=Swordfish
 GITLAB_SECRETS_DB_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 GITLAB_SECRETS_SECRET_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 GITLAB_SECRETS_OTP_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=["1234567890abcdef1234567890abcdef"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=["abcdef1234567890abcdef1234567890"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=fedcba0987654321fedcba0987654321
 EOF
 
 # 2. Deploy
@@ -45,6 +48,9 @@ GITLAB_ROOT_PASSWORD=Swordfish
 GITLAB_SECRETS_DB_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 GITLAB_SECRETS_SECRET_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
 GITLAB_SECRETS_OTP_KEY_BASE=1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=["1234567890abcdef1234567890abcdef"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=["abcdef1234567890abcdef1234567890"]
+GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=fedcba0987654321fedcba0987654321
 EOF
 
 # 2. Deploy from GHCR
@@ -67,7 +73,7 @@ This service includes all required backing stores:
 
 | Dependency | Container | Purpose |
 |------------|-----------|---------|
-| PostgreSQL | gitlab-postgres | Primary database (sameersbn/postgresql) |
+| PostgreSQL | gitlab-postgres | Primary database (kkimurak/sameersbn-postgresql) |
 | Redis | gitlab-redis | Cache and session store |
 
 See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
@@ -76,8 +82,8 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 
 | Container | Image | Purpose |
 |-----------|-------|---------|
-| gitlab | sameersbn/gitlab:18.8.0 | GitLab application server |
-| gitlab-postgres | sameersbn/postgresql:15-20230628 | PostgreSQL database |
+| gitlab | sameersbn/gitlab:19.1.0 | GitLab application server |
+| gitlab-postgres | kkimurak/sameersbn-postgresql:17 | PostgreSQL database |
 | gitlab-redis | redis:7-alpine | Redis cache and session store |
 
 ## Environment Variables
@@ -92,6 +98,9 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | `GITLAB_SECRETS_DB_KEY_BASE` | 64-char hex key for database encryption | Generate with `openssl rand -hex 64` |
 | `GITLAB_SECRETS_SECRET_KEY_BASE` | 64-char hex key for session secrets | Generate with `openssl rand -hex 64` |
 | `GITLAB_SECRETS_OTP_KEY_BASE` | 64-char hex key for OTP encryption | Generate with `openssl rand -hex 64` |
+| `GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY` | JSON array of key(s) for ActiveRecord encryption (GitLab 19+) | `["<32-char-key>"]` (generate with `openssl rand -hex 16`) |
+| `GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY` | JSON array of key(s) for deterministic encryption (GitLab 19+) | `["<32-char-key>"]` (generate with `openssl rand -hex 16`) |
+| `GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT` | Salt string for key derivation (GitLab 19+) | `<32-char-salt>` (generate with `openssl rand -hex 16`) |
 
 ### Optional
 

services/gitlab/docker-compose.yml

@@ -1,15 +1,15 @@
 name: gitlab
 services:
   database:
-    image: sameersbn/postgresql:${POSTGRES_TAG:-15-20230628}
+    image: kkimurak/sameersbn-postgresql:${POSTGRES_TAG:-17}
     container_name: gitlab-postgres
     volumes:
       - postgres_data:/var/lib/postgresql
     environment:
       DB_NAME: ${DB_NAME:-gitlabhq_production}
       DB_USER: ${DB_USER:-gitlab}
       DB_PASS: ${DB_PASS:-Swordfish}
-      DB_EXTENSION: pg_trgm
+      DB_EXTENSION: pg_trgm,btree_gist
     networks:
       - gitlab
     restart: unless-stopped
@@ -26,7 +26,7 @@ services:
         max-file: "50"
 
   gitlab:
-    image: sameersbn/gitlab:${GITLAB_VERSION:-18.9.2}
+    image: sameersbn/gitlab:${GITLAB_VERSION:-19.1.0}
     container_name: gitlab
     depends_on:
       - database
@@ -57,6 +57,9 @@ services:
       GITLAB_SECRETS_DB_KEY_BASE: ${GITLAB_SECRETS_DB_KEY_BASE:-changeme64chars0000000000000000000000000000000000000000000000000}
       GITLAB_SECRETS_SECRET_KEY_BASE: ${GITLAB_SECRETS_SECRET_KEY_BASE:-changeme64chars0000000000000000000000000000000000000000000000000}
       GITLAB_SECRETS_OTP_KEY_BASE: ${GITLAB_SECRETS_OTP_KEY_BASE:-changeme64chars0000000000000000000000000000000000000000000000000}
+      GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: '${GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY:-["changeme32charsprimarykey000001"]}'
+      GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: '${GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY:-["changeme32charsdeterministic0002"]}'
+      GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: ${GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT:-changeme32charsderivationsalt0003}
       # Features
       GITLAB_NOTIFY_ON_BROKEN_BUILDS: ${GITLAB_NOTIFY_ON_BROKEN_BUILDS:-true}
       GITLAB_PROJECTS_SNIPPETS: ${GITLAB_PROJECTS_SNIPPETS:-true}

services/graylog/README.md

@@ -80,8 +80,8 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 
 | Container | Image | Purpose |
 |-----------|-------|---------|
-| graylog | graylog/graylog:6.2 | Log management web interface and API |
-| graylog-elasticsearch | elasticsearch:7.17.27 | Search and indexing engine |
+| graylog | graylog/graylog:6.3 | Log management web interface and API |
+| graylog-elasticsearch | docker.elastic.co/elasticsearch/elasticsearch:7.17.29 | Search and indexing engine |
 | graylog-mongodb | mongo:8.0 | Configuration and metadata storage |
 
 ## Environment Variables

services/graylog/docker-compose.yml

@@ -32,7 +32,7 @@ services:
         hard: -1
 
   graylog:
-    image: graylog/graylog:${GRAYLOG_VERSION:-6.2}
+    image: graylog/graylog:${GRAYLOG_VERSION:-6.3}
     container_name: graylog
     depends_on:
       - elasticsearch
@@ -45,6 +45,7 @@ services:
       - GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000
       - GRAYLOG_HTTP_PUBLISH_URI=https://${SERVICE_DOMAIN:-example.com}
       - GRAYLOG_HTTP_EXTERNAL_URI=https://${SERVICE_DOMAIN:-example.com}/
+      - GRAYLOG_ELASTICSEARCH_HOSTS=${GRAYLOG_ELASTICSEARCH_HOSTS:-http://elasticsearch:9200}
       - GRAYLOG_TRANSPORT_EMAIL_ENABLED=${GRAYLOG_TRANSPORT_EMAIL_ENABLED:-false}
       - GRAYLOG_TRANSPORT_EMAIL_HOSTNAME=${GRAYLOG_TRANSPORT_EMAIL_HOSTNAME:-}
       - GRAYLOG_TRANSPORT_EMAIL_PORT=25

services/jira/README.md

@@ -88,7 +88,7 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | `POSTGRES_DB` | PostgreSQL database name | `jira` |
 | `JVM_MINIMUM_MEMORY` | JVM minimum heap size | `1024m` |
 | `JVM_MAXIMUM_MEMORY` | JVM maximum heap size | `2048m` |
-| `JIRA_VERSION` | Jira Software image tag | `10.6.1-ubi9-jdk17` |
+| `JIRA_VERSION` | Jira Software image tag | `11.3.7-ubi9-jdk21` |
 | `POSTGRES_TAG` | PostgreSQL image tag | `17-alpine` |
 
 ## Volumes

services/jira/docker-compose.yml

@@ -1,7 +1,7 @@
 name: jira
 services:
   jira:
-    image: atlassian/jira-software:${JIRA_VERSION:-11.3.3-ubi9-jdk21}
+    image: atlassian/jira-software:${JIRA_VERSION:-11.3.7-ubi9-jdk21}
     container_name: jira
     depends_on:
       - postgresql

services/keycloak/README.md

@@ -91,7 +91,7 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | `COMPOSE_PROJECT_NAME` | Docker Compose project name | `keycloak` |
 | `POSTGRES_DB` | PostgreSQL database name | `keycloak` |
 | `POSTGRES_USER` | PostgreSQL username | `keycloak` |
-| `KEYCLOAK_VERSION` | Keycloak image tag | `26.2` |
+| `KEYCLOAK_VERSION` | Keycloak image tag | `26.6.3` |
 | `POSTGRES_VERSION` | PostgreSQL image tag | `17` |
 
 ## Volumes
@@ -144,7 +144,7 @@ dc pull && dc up -d
 Keycloak has a `start_period` of 90 seconds. Wait for the container to become healthy. Check logs with `docker logs keycloak`.
 
 ### Cannot access admin console
-Ensure `KC_PROXY=edge` is set (default in this configuration) when running behind a reverse proxy like Traefik.
+Ensure `KC_PROXY_HEADERS=xforwarded` is set (default in this configuration) when running behind a reverse proxy like Traefik.
 
 ### Database connection errors
 Verify PostgreSQL is running and healthy: `docker logs keycloak-postgres`

services/keycloak/docker-compose.yml

@@ -1,7 +1,7 @@
 name: keycloak
 services:
   keycloak:
-    image: quay.io/keycloak/keycloak:${KEYCLOAK_VERSION:-26.5.5}
+    image: quay.io/keycloak/keycloak:${KEYCLOAK_VERSION:-26.6.3}
     container_name: keycloak
     depends_on:
       - postgres
@@ -12,7 +12,7 @@ services:
       KC_DB_PASSWORD: ${POSTGRES_PASS:-Swordfish}
       KEYCLOAK_ADMIN: ${KEYCLOAK_USER:-admin}
       KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_PASSWORD:-Swordfish}
-      KC_PROXY: edge
+      KC_PROXY_HEADERS: ${KC_PROXY_HEADERS:-xforwarded}
       KC_HOSTNAME: ${SERVICE_DOMAIN:-example.com}
       KC_HTTP_ENABLED: "true"
       KC_HEALTH_ENABLED: "true"

services/metabase/README.md

@@ -85,7 +85,7 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | `COMPOSE_PROJECT_NAME` | Docker Compose project name | `metabase` |
 | `DB_USER` | PostgreSQL username | `metabase` |
 | `DB_NAME` | PostgreSQL database name | `metabase` |
-| `METABASE_VERSION` | Metabase image tag | `latest` |
+| `METABASE_VERSION` | Metabase image tag | `v0.62.3.2` |
 | `POSTGRES_TAG` | PostgreSQL image tag | `15-alpine` |
 
 ## Volumes

services/metabase/docker-compose.yml

@@ -25,7 +25,7 @@ services:
         max-file: "50"
 
   metabase:
-    image: metabase/metabase:${METABASE_VERSION:-v0.59.3.2}
+    image: metabase/metabase:${METABASE_VERSION:-v0.62.3.2}
     container_name: metabase
     depends_on:
       - database

services/monica/README.md

@@ -119,7 +119,7 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | Container | Image | Purpose |
 |-----------|-------|---------|
 | monica | monica:5.0.0-beta.5-apache | Monica PRM application |
-| monica-mysql | mysql:8.0 | MySQL database |
+| monica-mysql | mysql:8.4 | MySQL database |
 
 ## Environment Variables
 
@@ -139,7 +139,7 @@ See [Service Dependency Graph](../../docs/DEPENDENCIES.md) for details.
 | `DB_USER` | MySQL username | `monica` |
 | `DB_NAME` | MySQL database name | `monica` |
 | `MONICA_VERSION` | Monica image tag | `5.0.0-beta.5-apache` |
-| `MYSQL_TAG` | MySQL image tag | `8.0` |
+| `MYSQL_TAG` | MySQL image tag | `8.4` |
 
 ### Application Settings (monica.env)
 

services/monica/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       - "traefik.docker.network=traefik_default"
 
   mysql:
-    image: mysql:${MYSQL_TAG:-8.0}
+    image: mysql:${MYSQL_TAG:-8.4}
     container_name: monica-mysql
     volumes:
       - mysql_data:/var/lib/mysql