Skip to content

infra: bump oauth2-proxy, n8n, open-webui, qdrant pins (2026-09-09 audit) #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AlienWalker1995 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

infra: bump oauth2-proxy, n8n, open-webui, qdrant pins (2026-09-09 audit) #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion services/automation/plugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ env:
services:
- name: n8n
# Pinned to the exact version V1 runs (V1 uses ${N8N_IMAGE:-...2.28.3}). Pin, don't float.
image: docker.n8n.io/n8nio/n8n:2.33.5
image: docker.n8n.io/n8nio/n8n:2.38.4
env:
N8N_HOST: 0.0.0.0
N8N_PORT: "5678"
Expand Down
2 changes: 1 addition & 1 deletion services/edge/plugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ secrets:
services:
- name: oauth2-proxy
# alpine variant ships wget for the healthcheck (the distroless :latest has no shell).
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3-alpine
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4-alpine
wants_secrets: true # OAUTH2_PROXY_* resolve from secrets.env
command:
- --provider=google
Expand Down
2 changes: 1 addition & 1 deletion services/open-webui/plugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ secrets:
services:
- name: open-webui
# Pinned to the exact version V1 runs (V1 uses ${OPEN_WEBUI_IMAGE:-...v0.10.1}). Pin, don't float.
image: ghcr.io/open-webui/open-webui:v0.11.0
image: ghcr.io/open-webui/open-webui:v0.11.3
wants_secrets: true # LITELLM_MASTER_KEY resolves from secrets.env
env:
ENABLE_OLLAMA_API: "false"
Expand Down
2 changes: 1 addition & 1 deletion services/rag/plugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ services:
- name: qdrant
# Vector DB — pinned to the exact version V1 runs. No host port in V2 (reached at qdrant:6333
# on the project network; V1's 127.0.0.1 publish was host-debug only).
image: qdrant/qdrant:v1.19.0
image: qdrant/qdrant:v1.19.1
volumes:
# NAMED VOLUME, not a ${DATA_PATH} 9p bind: qdrant mmaps its segments, and on
# Docker Desktop every 9p metadata op (stat during path walk) can wedge in
Expand Down
6 changes: 3 additions & 3 deletions tests/substrate/test_parity_render.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,9 @@ def test_parity_matrix_counts():
def test_ported_services_carry_pins_and_healthchecks():
# spot-check the exact V1 pins/healthchecks survived the port (no silent :latest drift)
c = _dual().compose_dict()
assert c["services"]["qdrant"]["image"] == "qdrant/qdrant:v1.19.0"
assert c["services"]["n8n"]["image"] == "docker.n8n.io/n8nio/n8n:2.33.5"
assert c["services"]["open-webui"]["image"] == "ghcr.io/open-webui/open-webui:v0.11.0"
assert c["services"]["qdrant"]["image"] == "qdrant/qdrant:v1.19.1"
assert c["services"]["n8n"]["image"] == "docker.n8n.io/n8nio/n8n:2.38.4"
assert c["services"]["open-webui"]["image"] == "ghcr.io/open-webui/open-webui:v0.11.3"
assert "@sha256:" in c["services"]["searxng"]["image"] # searxng pinned by digest
for svc in ("qdrant", "n8n", "open-webui", "rag-ingestion"):
assert "healthcheck" in c["services"][svc]
Expand Down
Loading