chore(deps): pin 7 floating ':latest' images to explicit versions #669

New issue

Closed

opened 2026-06-01 15:05:36 +02:00 by claude · 0 comments

claude commented

2026-06-01 15:05:36 +02:00

Collaborator

Finding

Dependency audit (2026-06-01, live rs2000 docker ps): 7 containers run :latest (unpinned):

service	image
silverbullet	`ghcr.io/silverbulletmd/silverbullet:latest`
memos	`ghcr.io/usememos/memos:stable`
radicale	`ghcr.io/kozea/radicale:latest`
openhabittracker	`jinjinov/openhabittracker:latest`
meerkat-crm-frontend	`ghcr.io/fbuchner/meerkat-crm-frontend:latest`
meerkat-crm-backend	`ghcr.io/fbuchner/meerkat-crm-backend:latest`
tududi	`chrisvel/tududi:latest`

(memos uses :stable — same problem: a floating tag with no fixed version.)

Why it matters

:latest / :stable = silent drift (the image changes under you on every pull; not reproducible; no version control). Worse, it's a Renovate/Dependabot blind spot — version-bumping tools can't propose "latest+1" because there's no version to increment.

So this issue is the necessary precondition for the Renovate setup issue to cover these 7. Without explicit version pins, they stay invisible to automation forever.

Scope

For each image: resolve the current running version (docker inspect digest → match to a registry tag), then pin the image in the compose file / module manifest to that explicit version (ideally digest-pinned — the manifests currently report image_digest_pinned_in_compose: false).
Sunset check first: some of these are sunset candidates (e.g. silverbullet was marked for sunset — Obsidian is the single source of truth). Confirm keep-vs-remove before pinning; don't pin something that should be retired.

Acceptance criteria

0 floating tags (:latest / :stable) for active modules in compose/*.
Each pinned to an explicit version (digest-pinned where possible).
Sunset candidates among the 7 confirmed kept-or-removed (not blindly pinned).
Renovate can now track all of them (verify after the Renovate issue lands).

Authored by claude (audit/capture); execution = Codex lane.

## Finding Dependency audit (2026-06-01, live rs2000 `docker ps`): **7 containers run `:latest`** (unpinned): | service | image | |---|---| | silverbullet | `ghcr.io/silverbulletmd/silverbullet:latest` | | memos | `ghcr.io/usememos/memos:stable` | | radicale | `ghcr.io/kozea/radicale:latest` | | openhabittracker | `jinjinov/openhabittracker:latest` | | meerkat-crm-frontend | `ghcr.io/fbuchner/meerkat-crm-frontend:latest` | | meerkat-crm-backend | `ghcr.io/fbuchner/meerkat-crm-backend:latest` | | tududi | `chrisvel/tududi:latest` | (`memos` uses `:stable` — same problem: a floating tag with no fixed version.) ## Why it matters `:latest` / `:stable` = **silent drift** (the image changes under you on every pull; not reproducible; no version control). Worse, it's a **Renovate/Dependabot blind spot** — version-bumping tools can't propose "latest+1" because there's no version to increment. So this issue is the **necessary precondition** for the Renovate setup issue to cover these 7. Without explicit version pins, they stay invisible to automation forever. ## Scope - For each image: resolve the current running version (`docker inspect` digest → match to a registry tag), then pin the image in the compose file / module manifest to that **explicit version** (ideally digest-pinned — the manifests currently report `image_digest_pinned_in_compose: false`). - **Sunset check first:** some of these are sunset candidates (e.g. `silverbullet` was marked for sunset — Obsidian is the single source of truth). Confirm keep-vs-remove before pinning; don't pin something that should be retired. ## Acceptance criteria - [ ] 0 floating tags (`:latest` / `:stable`) for active modules in `compose/*`. - [ ] Each pinned to an explicit version (digest-pinned where possible). - [ ] Sunset candidates among the 7 confirmed kept-or-removed (not blindly pinned). - [ ] Renovate can now track all of them (verify after the Renovate issue lands). Authored by claude (audit/capture); execution = Codex lane.

claude added this to the 10 - Improvements milestone

2026-06-01 15:05:36 +02:00

claude added the

agent/codex

priority:p2

labels

2026-06-01 15:05:36 +02:00

claude referenced this issue

2026-06-01 17:19:13 +02:00

chore(deps): set up Renovate for automated dependency updates (Forgejo-native) #667

claude referenced this issue

2026-06-01 17:19:15 +02:00