Cryptograss:Moods/general/todo: Difference between revisions
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
m Merged, says GitHub: https://github.com/cryptograss/memory-lane/pull/159 |
m Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/242 |
||
| (16 intermediate revisions by 2 users not shown) | |||
| Line 2: | Line 2: | ||
<todo> | <todo> | ||
- task: "Merge maybelle-config#216 and deploy pickipedia-vps: Caddy refuses big (10 MB+) and chunked bodies until PHP 8.2.35" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/maybelle-config/pull/216 | |||
note: "PHP's advisory: CVE-2026-109618 is out-of-memory while reading any request body, not only multipart. Then, when Docker's php:8.2-apache carries 8.2.35 (not yet at 15:00Z), deploy again and revert #215 and #216." | |||
done: true | |||
- task: "Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/maybelle-config/pull/215 | |||
note: "Stopgap: attacks seen in the wild, fix lands 14:00 UTC. Uploads pause. Revert #215 once X-Powered-By says PHP/8.2.35." | |||
done: true | |||
- task: "Morning check on the PHP CVE, at block ~26,241,113 (about 13:00 UTC, 21 Oct)" | |||
who: magent | |||
by: jMyles | |||
kind: check | |||
note: "Has PHP 8.2.35 shipped (then Justin deploys pickipedia-vps)? Is the demo still down (:4009/:14003)? Any working exploit published? Live wiki still healthy? Ask re if needed." | |||
done: "15:06Z: PHP 8.2.35 out, Docker image not yet; stopgaps checked live, HTTP/2 gap found (#217)" | |||
- task: "Merge maybelle-config#217 and deploy pickipedia-vps: refuse POST/PUT/PATCH with no declared size" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/maybelle-config/pull/217 | |||
note: "Gap in #216: a 12 MB HTTP/2 POST with no Content-Length got 200 live." | |||
done: true | |||
- task: "Merge pickipedia#152: preview wikis on hunter get session.upload_progress off too" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/pickipedia/pull/152 | |||
note: "Companion to maybelle-config#212, for the image hunter's public preview wikis run. All previews were down (502) on 21 Oct, so it's for the next one someone starts." | |||
done: "Closed by Justin 30 Oct; upstream php:8.2-apache carried 8.2.35" | |||
- task: "Deploy pickipedia-vps again once PHP 8.2.35 ships, and check X-Powered-By says 8.2.35" | |||
who: jMyles | |||
by: magent | |||
kind: deploy | |||
link: https://github.com/cryptograss/maybelle-config/pull/212 | |||
note: "Done via #218 and #220 (FROM amd64/php:8.2.35-apache; the shared php:8.2.35-apache tag had no images yet). Live says PHP/8.2.35 at 16:38Z. Stopgaps #215-#217 removed by #219 (16:44Z: multipart and 12 MB posts get 200 again)." | |||
done: "2026-10-21 16:44Z" | |||
- task: "Merge maybelle-config#242 and deploy pickipedia-vps: switch amd64/php back to php:8.2.35-apache" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/maybelle-config/pull/242 | |||
note: "Upstream multi-arch manifests are in place. Reminder: plan move off PHP 8.2 before 31 Dec 2026 EOL." | |||
done: true | |||
- task: "Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHP" | |||
who: jMyles | |||
by: magent | |||
kind: merge | |||
link: https://github.com/cryptograss/maybelle-config/pull/212 | |||
note: "PHP use-after-free (CVE-2026-109618/-109619). The wiki runs PHP 8.2.34 with upload_progress at its default, On. Then deploy again once PHP 8.2.35 ships; --pull makes that deploy pick it up." | |||
done: true | |||
- task: "Merge memory-lane#159 and deploy maybelle: a failed image upload's error stays on screen" | - task: "Merge memory-lane#159 and deploy maybelle: a failed image upload's error stays on screen" | ||
who: jMyles | who: jMyles | ||
Latest revision as of 16:25, 30 October 2026
What this Mood is waiting on, and who has it.
Nothing to do.
Done (9)
- ☑Merge maybelle-config#216 and deploy pickipedia-vps: Caddy refuses big (10 MB+) and chunked bodies until PHP 8.2.35PHP's advisory: CVE-2026-109618 is out-of-memory while reading any request body, not only multipart. Then, when Docker's php:8.2-apache carries 8.2.35 (not yet at 15:00Z), deploy again and revert #215 and #216.
- ☑Merge maybelle-config#215 and deploy pickipedia-vps NOW: Caddy refuses multipart until PHP 8.2.35Stopgap: attacks seen in the wild, fix lands 14:00 UTC. Uploads pause. Revert #215 once X-Powered-By says PHP/8.2.35.
- ☑Morning check on the PHP CVE, at block ~26,241,113 (about 13:00 UTC, 21 Oct)Has PHP 8.2.35 shipped (then Justin deploys pickipedia-vps)? Is the demo still down (:4009/:14003)? Any working exploit published? Live wiki still healthy? Ask re if needed.
- ☑Merge maybelle-config#217 and deploy pickipedia-vps: refuse POST/PUT/PATCH with no declared sizeGap in #216: a 12 MB HTTP/2 POST with no Content-Length got 200 live.
- ☑Merge pickipedia#152: preview wikis on hunter get session.upload_progress off tooCompanion to maybelle-config#212, for the image hunter's public preview wikis run. All previews were down (502) on 21 Oct, so it's for the next one someone starts.
- ☑Deploy pickipedia-vps again once PHP 8.2.35 ships, and check X-Powered-By says 8.2.35Done via #218 and #220 (FROM amd64/php:8.2.35-apache; the shared php:8.2.35-apache tag had no images yet). Live says PHP/8.2.35 at 16:38Z. Stopgaps #215-#217 removed by #219 (16:44Z: multipart and 12 MB posts get 200 again).
- ☑Merge maybelle-config#242 and deploy pickipedia-vps: switch amd64/php back to php:8.2.35-apacheUpstream multi-arch manifests are in place. Reminder: plan move off PHP 8.2 before 31 Dec 2026 EOL.
- ☑Merge maybelle-config#212 and deploy pickipedia-vps: PHP session.upload_progress off, build pulls current PHPPHP use-after-free (CVE-2026-109618/-109619). The wiki runs PHP 8.2.34 with upload_progress at its default, On. Then deploy again once PHP 8.2.35 ships; --pull makes that deploy pick it up.
- ☑Merge memory-lane#159 and deploy maybelle: a failed image upload's error stays on screenSky's screenshot paste 'glitched out and disappeared' (10 Oct): the error was cleared the instant it appeared. Three-line reorder, untested in a browser.