Cryptograss:Moods/general/todo - Revision history

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/242

2026-10-30T16:25:06Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/242

← Older revision		Revision as of 16:25, 30 October 2026
Line 49:		Line 49:
	link: https://github.com/cryptograss/maybelle-config/pull/242		link: https://github.com/cryptograss/maybelle-config/pull/242
	note: "Upstream multi-arch manifests are in place. Reminder: plan move off PHP 8.2 before 31 Dec 2026 EOL."		note: "Upstream multi-arch manifests are in place. Reminder: plan move off PHP 8.2 before 31 Dec 2026 EOL."
			done: true
	- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"		- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"
	who: jMyles		who: jMyles

Magent: pickipedia#152 closed, maybelle-config#242 opened for PHP unpin (via update-page on MediaWiki MCP Server)

2026-10-30T16:20:59Z

pickipedia#152 closed, maybelle-config#242 opened for PHP unpin (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 16:20, 30 October 2026
Line 35:		Line 35:
	link: https://github.com/cryptograss/pickipedia/pull/152		link: https://github.com/cryptograss/pickipedia/pull/152
	note: "Companion to maybelle-config#212, for the image hunter's public preview wikis run. All previews were down (502) on 21 Oct, so it's for the next one someone starts."		note: "Companion to maybelle-config#212, for the image hunter's public preview wikis run. All previews were down (502) on 21 Oct, so it's for the next one someone starts."
			done: "Closed by Justin 30 Oct; upstream php:8.2-apache carried 8.2.35"
	- task: "Deploy pickipedia-vps again once PHP 8.2.35 ships, and check X-Powered-By says 8.2.35"		- task: "Deploy pickipedia-vps again once PHP 8.2.35 ships, and check X-Powered-By says 8.2.35"
	who: jMyles		who: jMyles
Line 42:		Line 43:
	note: "Done via #218 and #220 (FROM amd64/php:8.2.35-apache; the shared php:8.2.35-apache tag had no images yet). Live says PHP/8.2.35 at 16:38Z. Stopgaps #215-#217 removed by #219 (16:44Z: multipart and 12 MB posts get 200 again)."		note: "Done via #218 and #220 (FROM amd64/php:8.2.35-apache; the shared php:8.2.35-apache tag had no images yet). Live says PHP/8.2.35 at 16:38Z. Stopgaps #215-#217 removed by #219 (16:44Z: multipart and 12 MB posts get 200 again)."
	done: "2026-10-21 16:44Z"		done: "2026-10-21 16:44Z"
	- task: "~~Next PHP bump~~: ~~go back from~~ amd64/php to php:8.2.~~<n>~~-apache~~, and plan the move off 8.2 (end of life 31 Dec 2026)~~"		- task: "Merge maybelle-config#242 and deploy pickipedia-vps: switch amd64/php back to php:8.2.35-apache"
	who: jMyles		who: jMyles
	by: magent		by: magent
	kind: ~~code~~		kind: merge
	note: "~~The amd64/php pin from #220 was a workaround for one afternoon~~."		link: https://github.com/cryptograss/maybelle-config/pull/242
			note: "Upstream multi-arch manifests are in place. Reminder: plan move off PHP 8.2 before 31 Dec 2026 EOL."
	- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"		- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"
	who: jMyles		who: jMyles

Magent: PHP 8.2.35 live, stopgaps removed (this edit is the test that bot edits work again) (via update-page on MediaWiki MCP Server)

2026-10-21T16:45:08Z

PHP 8.2.35 live, stopgaps removed (this edit is the test that bot edits work again) (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 16:45, 21 October 2026
Line 40:		Line 40:
	kind: deploy		kind: deploy
	link: https://github.com/cryptograss/maybelle-config/pull/212		link: https://github.com/cryptograss/maybelle-config/pull/212
	note: "~~NOT done yet~~: ~~live still says PHP/~~8.2.~~34 at 15~~:~~06Z~~. PHP ~~released~~ 8.2.35 at ~~14:09Z, but Docker's php~~:8.2-~~apache hasn't been rebuilt~~ (~~docker-library/official-images#22541 open~~). ~~Once it has~~: ~~deploy (~~--~~pull picks it up), check X~~-~~Powered-By says~~ 8.2.~~35, then revert #215~~, ~~#216~~ and ~~#217~~."		note: "Done via #218 and #220 (FROM amd64/php:8.2.35-apache; the shared php:8.2.35-apache tag had no images yet). Live says PHP/8.2.35 at 16:38Z. Stopgaps #215-#217 removed by #219 (16:44Z: multipart and 12 MB posts get 200 again)."
	~~done~~: ~~true~~		done: "2026-10-21 16:44Z"
			- task: "Next PHP bump: go back from amd64/php to php:8.2.<n>-apache, and plan the move off 8.2 (end of life 31 Dec 2026)"
			who: jMyles
			by: magent
			kind: code
			note: "The amd64/php pin from #220 was a workaround for one afternoon."
	- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"		- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"
	who: jMyles		who: jMyles

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/217

2026-10-21T15:38:40Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/217

← Older revision		Revision as of 15:38, 21 October 2026
Line 28:		Line 28:
	link: https://github.com/cryptograss/maybelle-config/pull/217		link: https://github.com/cryptograss/maybelle-config/pull/217
	note: "Gap in #216: a 12 MB HTTP/2 POST with no Content-Length got 200 live."		note: "Gap in #216: a 12 MB HTTP/2 POST with no Content-Length got 200 live."
			done: true
	- task: "Merge pickipedia#152: preview wikis on hunter get session.upload_progress off too"		- task: "Merge pickipedia#152: preview wikis on hunter get session.upload_progress off too"
	who: jMyles		who: jMyles

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/212

2026-10-21T15:08:39Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/212

← Older revision		Revision as of 15:08, 21 October 2026
Line 40:		Line 40:
	link: https://github.com/cryptograss/maybelle-config/pull/212		link: https://github.com/cryptograss/maybelle-config/pull/212
	note: "NOT done yet: live still says PHP/8.2.34 at 15:06Z. PHP released 8.2.35 at 14:09Z, but Docker's php:8.2-apache hasn't been rebuilt (docker-library/official-images#22541 open). Once it has: deploy (--pull picks it up), check X-Powered-By says 8.2.35, then revert #215, #216 and #217."		note: "NOT done yet: live still says PHP/8.2.34 at 15:06Z. PHP released 8.2.35 at 14:09Z, but Docker's php:8.2-apache hasn't been rebuilt (docker-library/official-images#22541 open). Once it has: deploy (--pull picks it up), check X-Powered-By says 8.2.35, then revert #215, #216 and #217."
			done: true
	- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"		- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"
	who: jMyles		who: jMyles

Magent: morning check done; #217 (via update-page on MediaWiki MCP Server)

2026-10-21T15:07:22Z

morning check done; #217 (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 15:07, 21 October 2026
Line 21:		Line 21:
	kind: check		kind: check
	note: "Has PHP 8.2.35 shipped (then Justin deploys pickipedia-vps)? Is the demo still down (:4009/:14003)? Any working exploit published? Live wiki still healthy? Ask re if needed."		note: "Has PHP 8.2.35 shipped (then Justin deploys pickipedia-vps)? Is the demo still down (:4009/:14003)? Any working exploit published? Live wiki still healthy? Ask re if needed."
			done: "15:06Z: PHP 8.2.35 out, Docker image not yet; stopgaps checked live, HTTP/2 gap found (#217)"
			- task: "Merge maybelle-config#217 and deploy pickipedia-vps: refuse POST/PUT/PATCH with no declared size"
			who: jMyles
			by: magent
			kind: merge
			link: https://github.com/cryptograss/maybelle-config/pull/217
			note: "Gap in #216: a 12 MB HTTP/2 POST with no Content-Length got 200 live."
	- task: "Merge pickipedia#152: preview wikis on hunter get session.upload_progress off too"		- task: "Merge pickipedia#152: preview wikis on hunter get session.upload_progress off too"
	who: jMyles		who: jMyles

Magent: 8.2.35 deploy not done yet (via update-page on MediaWiki MCP Server)

2026-10-21T15:07:15Z

8.2.35 deploy not done yet (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 15:07, 21 October 2026
Line 32:		Line 32:
	kind: deploy		kind: deploy
	link: https://github.com/cryptograss/maybelle-config/pull/212		link: https://github.com/cryptograss/maybelle-config/pull/212
	note: "~~The second half of the~~ PHP ~~upload_progress fix~~. ~~#212 is live (deploy 26239383, 21 Oct)~~: ~~upload_progress is off~~, but ~~the multipart~~-~~parser path stays~~ open ~~until PHP itself is patched~~. --pull ~~means the next deploy after the release~~ picks it up~~. Optional~~ check ~~now: docker exec pickipedia~~-~~wiki php~~ -~~i \| grep upload_progress~~.~~enabled~~"		note: "NOT done yet: live still says PHP/8.2.34 at 15:06Z. PHP released 8.2.35 at 14:09Z, but Docker's php:8.2-apache hasn't been rebuilt (docker-library/official-images#22541 open). Once it has: deploy (--pull picks it up), check X-Powered-By says 8.2.35, then revert #215, #216 and #217."
	~~done: true~~
	- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"		- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP"
	who: jMyles		who: jMyles

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/216

2026-10-21T15:03:29Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/216

← Older revision		Revision as of 15:03, 21 October 2026
Line 8:		Line 8:
	link: https://github.com/cryptograss/maybelle-config/pull/216		link: https://github.com/cryptograss/maybelle-config/pull/216
	note: "PHP's advisory: CVE-2026-109618 is out-of-memory while reading any request body, not only multipart. Then, when Docker's php:8.2-apache carries 8.2.35 (not yet at 15:00Z), deploy again and revert #215 and #216."		note: "PHP's advisory: CVE-2026-109618 is out-of-memory while reading any request body, not only multipart. Then, when Docker's php:8.2-apache carries 8.2.35 (not yet at 15:00Z), deploy again and revert #215 and #216."
			done: true
	- task: "Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35"		- task: "Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35"
	who: jMyles		who: jMyles

Magent: maybelle-config#216 (via update-page on MediaWiki MCP Server)

2026-10-21T14:58:27Z

maybelle-config#216 (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 14:58, 21 October 2026
Line 2:		Line 2:

	<todo>		<todo>
			- task: "Merge maybelle-config#216 and deploy pickipedia-vps: Caddy refuses big (10 MB+) and chunked bodies until PHP 8.2.35"
			who: jMyles
			by: magent
			kind: merge
			link: https://github.com/cryptograss/maybelle-config/pull/216
			note: "PHP's advisory: CVE-2026-109618 is out-of-memory while reading any request body, not only multipart. Then, when Docker's php:8.2-apache carries 8.2.35 (not yet at 15:00Z), deploy again and revert #215 and #216."
	- task: "Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35"		- task: "Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35"
	who: jMyles		who: jMyles

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/215

2026-10-21T10:12:18Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/215

← Older revision		Revision as of 10:12, 21 October 2026
Line 8:		Line 8:
	link: https://github.com/cryptograss/maybelle-config/pull/215		link: https://github.com/cryptograss/maybelle-config/pull/215
	note: "Stopgap: attacks seen in the wild, fix lands 14:00 UTC. Uploads pause. Revert #215 once X-Powered-By says PHP/8.2.35."		note: "Stopgap: attacks seen in the wild, fix lands 14:00 UTC. Uploads pause. Revert #215 once X-Powered-By says PHP/8.2.35."
			done: true
	- task: "Morning check on the PHP CVE, at block ~26,241,113 (about 13:00 UTC, 21 Oct)"		- task: "Morning check on the PHP CVE, at block ~26,241,113 (about 13:00 UTC, 21 Oct)"
	who: magent		who: magent