Defect log

The image's org.opencontainers.image.licenses label says "Apache-2.0 AND LGPL-2.1-only", which understates its licences. runc (static-pie, the only binary here that links C) links the GNU C Library 2.36, LGPL-2.1-or-later: Debian's glibc 2.36-9+deb12u14 (libc6-dev) from the pinned builder image golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af, besides libseccomp 2.6.1 (LGPL-2.1-only). The full licence set is Apache-2.0 AND LGPL-2.1-only AND LGPL-2.1-or-later. libgcc (GCC 12.2.0, GPL-3.0-or-later WITH GCC-exception-3.1) is linked into runc too; its runtime library exception puts no licence condition on runc. Corresponding source: glibc, https://snapshot.debian.org/package/glibc/2.36-9%2Bdeb12u14/ (glibc_2.36-9+deb12u14.dsc, glibc_2.36.orig.tar.xz, glibc_2.36-9+deb12u14.debian.tar.xz); libseccomp, vendored/libseccomp in this kit. This kit carries runc's source and the builder image whose libc.a was linked, so runc can be rebuilt and relinked offline. The image's SPDX document (/usr/local/share/readystack/sbom/runc.spdx.json) lists libc6-dev 2.36-9+deb12u14 with licenseDeclared NOASSERTION, and /usr/local/share/kubernetesnode/licenses/ holds no glibc licence. The next revision corrects the label, declares the licences in the SBOM and adds glibc's copyright file there.

Expected

org.opencontainers.image.licenses = "Apache-2.0 AND LGPL-2.1-only AND LGPL-2.1-or-later"

Actual

org.opencontainers.image.licenses = "Apache-2.0 AND LGPL-2.1-only"

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v1.36.6-CE-scratch-r2

Found by

review

Round 2's finding is not corrected: the image is not a service (no ports, NOT_TRUE in doc_facts, `docker run` just prints v1.36.6 and exits 0), yet three notes (lines 35, 36, 37) are prefixed 'Before exposing this service'. The prefix is added by the renderer to every strategy security_notes entry (the strategy's three entries contain no such words), so it is an engine fix. The advice itself is true.

Expected

- **Before installing this bundle on a host:** containerd and kubelet run as root on the host, like every Kubernetes node's; the image's own default user (65534) applies only to running the binaries in the image.

Actual

- **Before exposing this service:** containerd and kubelet run as root on the host, like every Kubernetes node's; the image's own default user (65534) applies only to running the binaries in the image.

Resolution

Carried from RSD-kubernetesnode-e805be98cf (v1.36.6-CE-scratch-r1), a release this one supersedes: open there, and nothing shows it no longer applies here.

Record match

No public record applies

Release

v1.36.6-CE-scratch-r2

Found by

review

Unchanged from the previous round's open finding: the handbook never says where kubernetesnode-v1.36.6-linux-amd64.tar.gz and its .sha256 (lines 373-374, 637) come from; neither the image nor the sale archive contains them, the build kit builds them with BUILD_TARBALL.sh. Not a new regression.

Expected

`install-node.sh` installs the Kubernetes Node bundle, the tarball `BUILD_TARBALL.sh` in the `readystack/kubernetesnode` build kit builds (the image does not contain it): kubelet, kubeadm,

Actual

`install-node.sh` installs the Kubernetes Node bundle (`readystack/kubernetesnode`'s tarball): kubelet, kubeadm,

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v1.36.6-CE-scratch-r2

Found by

review

Image is not a service (no ports, NOT_TRUE 'no service, no ports'; docker run prints v1.36.6 and exits 0), yet the renderer prefixes every security note (lines 35-37; also SECURITY_REPORT.md:19-21) with 'Before exposing this service'. Engine fix; advice itself true. Open ledger row RSD-kubernetesnode-683f933c76 still applies.

Expected

- **Before installing this bundle on a host:** /etc/containerd/config.toml holds the local registry's credential (base64 of user:password, not encrypted): it is written root-only (0600). Use a pull-only account.

Actual

- **Before exposing this service:** /etc/containerd/config.toml holds the local registry's credential (base64 of user:password, not encrypted): it is written root-only (0600). Use a pull-only account.

Record match

No public record applies

Release

v1.36.6-CE-scratch-r2

Found by

review

Wrong release tag (r2) in prose contradicting the pull command and release tag

Expected

The official image is hosted at `readystack/temporal`. Retrieve the specific version `v1.32.2-CE-ubuntu24.04-r1` using the following command:

Actual

The official image is hosted at `readystack/temporal`. Retrieve the specific version `v1.32.2-CE-ubuntu24.04-r2` using the following command:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v1.32.2-CE-ubuntu24.04-r1

Found by

review

Turning on the JWT authorizer protects the frontend ports (7233 gRPC, 7243 HTTP), but the internal frontend ports 7236 and 7246 still answer without a token to any container that can reach them (for example on the same Docker network). Separately, the authorizer and claim mapper are off by default, so any client that reaches the frontend ports has full control of every namespace and workflow.

Source

RSD-temporal-a731bf09b3

Resolution

Matched: https://github.com/advisories/GHSA-vrgw-vghm-5p74 — "which authorizes every request as a system administrator without requiring authentication information" Carried from RSD-temporal-71f1c69845 (v1.32.0-CE-ubuntu24.04-r1), a release this one supersedes: open there, and nothing shows it no longer applies here.

Upstream issue

https://github.com/temporalio/temporal/pull/3706

Public records

https://github.com/temporalio/temporal/pull/3706, https://docs.temporal.io/self-hosted-guide/security, https://github.com/advisories/GHSA-vrgw-vghm-5p74

Record match

Matched to a public record

Release

v1.32.2-CE-ubuntu24.04-r1

Found by

strategy

Without QDRANT__SERVICE__API_KEY, anyone who reaches ports 6333/6334 can read, change and delete all collections, including through the dashboard. Set an API key, or keep the ports on a private network.

Record match

No public record found

Release

v1.20.0-CE-ubuntu24.04-r2

Found by

strategy

Upstream Project bullet gives the stale version v4.16.2.

Expected

* **Version:** v4.16.7

Actual

* **Version:** v4.16.2

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v4.16.7-CE-ubuntu24.04-r1

Found by

review

Upstream Reference names the wrong NodeBB version (v4.16.2), contradicting every other version statement.

Expected

This product is based on **NodeBB**, a modern, real-time forum software. The specific version deployed in this release is **v4.16.7**.

Actual

This product is based on **NodeBB**, a modern, real-time forum software. The specific version deployed in this release is **v4.16.2**.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v4.16.7-CE-ubuntu24.04-r1

Found by

review

Two runs of `./nodebb build` on the same tree differ in 85 of 11,146 emitted files: build/cache-buster is random by design, and 84 language files vary because src/meta/languages.js mutates one object from concurrent Promise.all callbacks, so JSON key order shifts between runs. Anyone rebuilding NodeBB's assets from source gets different bytes each time.

Resolution

Carried from RSD-nodebb-69ef4ce66c (v4.16.0-CE-bookworm-r2), a release this one supersedes: open there, and nothing shows it no longer applies here.

Record match

No public record found

Release

v4.16.7-CE-ubuntu24.04-r1

Found by

strategy

NodeBB uses NODEBB_ADMIN_PASSWORD only when it creates the administrator on an empty database; the image keeps config.json inside the container, so every new container runs setup again and needs the variable. This image's entrypoint nevertheless refuses to start without NODEBB_ADMIN_PASSWORD, so a deployment cannot drop the variable after setup and the first administrator's password stays in the container's environment (docker inspect, /proc/1/environ) unless the operator replaces its value, which the next release's run note now says. Found while testing the run examples after the 2026-10-22 agent case study (readystack.dev/agent-case-study.html). The entrypoint needs to require it only when the database is empty; the image changes only with a new release.

Expected

After setup the container starts without NODEBB_ADMIN_PASSWORD.

Actual

Recreated on the same volumes without NODEBB_ADMIN_PASSWORD, the container exits at start.

Resolution

Carried from RSD-nodebb-82ea397569 (v4.16.3-CE-ubuntu24.04-r1), a release this one supersedes: open there, and nothing shows it no longer applies here.

Record match

No public record applies

Release

v4.16.7-CE-ubuntu24.04-r1

Found by

runtime

The /setup page creates the administrator for whoever reaches it first. Complete setup before the port is reachable by others.

Record match

No public record found

Release

v26.9.0-CE-ubuntu24.04-r5

Found by

strategy

Only the API guide (L954) says the password in DATABASE_URL must be percent-encoded. A customer who follows this handbook with a password containing a space or shell-special characters gets a crash on boot.

Expected

DATABASE_URL=postgres://username:password@host:port/database (percent-encode special characters in the username and password: my new pass $x! becomes my%20new%20pass%20%24x%21)

Actual

DATABASE_URL=postgres://username:password@host:port/database

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v17.9.6-CE-ubuntu24.04-r1

Found by

review

admin / admin — upstream's default password for the administrator `admin` that the seeder (./docker/prod/seeder, rake db:seed) creates when OPENPROJECT_SEED_ADMIN_USER_PASSWORD is not set (config/constants/settings/definition.rb seed_admin_user_password, default "admin"; app/seeders/admin_user_seeder.rb). OpenProject forces a new password at the first sign-in unless OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET=false (seed_admin_user_password_reset, default true). Measured on readystack/openproject@sha256:e2307444 (2026-10-20): a seeder run without the variable left admin with password admin, force_password_change true. Set OPENPROJECT_SEED_ADMIN_USER_PASSWORD for the seeder, and sign in before exposing the instance

Record match

No public record found

Release

v17.9.6-CE-ubuntu24.04-r1

Found by

strategy

The metrics port 20241 has no authentication and also serves /debug/pprof (Go profiling) and /config (the tunnel's ingress rules). Publish it only to a private network, or not at all.

Record match

No public record found

Release

2026.10.7-CE-ubuntu24.04-r1

Found by

strategy

Stale JAVA_VERSION: the image sets jdk-21.0.13+9, handbook states the previous JDK value.

Expected

* **JAVA_VERSION**: Set to `jdk-21.0.13+9`.

Actual

* **JAVA_VERSION**: Set to `jdk-21.0.12.1+1`.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

2.580.2-CE-ubuntu24.04-r1

Found by

review

Stale JAVA_VERSION: the image sets jdk-21.0.13+9, handbook states the previous JDK value.

Expected

* `JAVA_VERSION=jdk-21.0.13+9`

Actual

* `JAVA_VERSION=jdk-21.0.12.1+1`

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

2.580.2-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The server is licensed under AGPL-3.0-only and the web vault UI under GPL-3.0-only. If you modify the product or use it in a way that triggers the AGPL-3.0 network use clause, you are required to make the corresponding source code available to your users. The container image holds no Vaultwarden source code, license text or build files, only the license labels `org.opencontainers.image.licenses` and `com.readystack.license.disclosure`. The server's corresponding source (`vendored/vaultwarden-src`, with its vendored crates) and the build kit are in the release archive; the web vault is in the archive, as in the image, only as its prebuilt files, and its source is published upstream at https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.10.1. For specific instructions on rebuilding the image from source or accessing the full source tree, please consult the `docs/REBUILD.md` and `docs/PROVENANCE.md` files included in the release archive.

Actual

The server is licensed under AGPL-3.0-only and the web vault UI under GPL-3.0-only. If you modify the product or use it in a way that triggers the AGPL-3.0 network use clause, you are required to make the corresponding source code available to your users. The container image holds no Vaultwarden source code, license text or build files, only the license labels `org.opencontainers.image.licenses` and `com.readystack.license.disclosure`. The server's corresponding source (`vendored/vaultwarden-src`, with its vendored crates) and the build kit are in the release archive; the web vault is in the archive, as in the image, only as its prebuilt files, and its source is published upstream at https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.7.0. For specific instructions on rebuilding the image from source or accessing the full source tree, please consult the `docs/REBUILD.md` and `docs/PROVENANCE.md` files included in the release archive.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The product includes a prebuilt web vault user interface, derived from `dani-garcia/bw_web_builds` (version 2026.10.1), which is licensed under the **GNU General Public License version 3.0-only (GPL-3.0-only)**. This UI is embedded within the container image and served statically. The corresponding source code for the web vault component is also available per the terms of the GPL-3.0.

Actual

The product includes a prebuilt web vault user interface, derived from `dani-garcia/bw_web_builds` (version 2026.7.0), which is licensed under the **GNU General Public License version 3.0-only (GPL-3.0-only)**. This UI is embedded within the container image and served statically. The corresponding source code for the web vault component is also available per the terms of the GPL-3.0.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* **`GET /api/version`**: Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.5"`). The response includes the quotes and does not include the word "Vaultwarden".

Actual

* **`GET /api/version`**: Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.4"`). The response includes the quotes and does not include the word "Vaultwarden".

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The Vaultwarden container serves a prebuilt Bitwarden-compatible web vault interface directly from the `/web-vault` directory within the container image. This UI is derived from the `dani-garcia/bw_web_builds` project (version 2026.10.1, licensed under GPL-3.0-only) and is stored there as files, separate from the server binary. The server itself is licensed under AGPL-3.0-only. The interface is served via the same HTTP listener that handles the API, meaning it is accessible on port 8080 (or the host-mapped port) alongside the API endpoints.

Actual

The Vaultwarden container serves a prebuilt Bitwarden-compatible web vault interface directly from the `/web-vault` directory within the container image. This UI is derived from the `dani-garcia/bw_web_builds` project (version 2026.7.0, licensed under GPL-3.0-only) and is stored there as files, separate from the server binary. The server itself is licensed under AGPL-3.0-only. The interface is served via the same HTTP listener that handles the API, meaning it is accessible on port 8080 (or the host-mapped port) alongside the API endpoints.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The bundled web vault interface is served directly by the Vaultwarden server from the `/web-vault` directory within the container image. This interface is a prebuilt Bitwarden-compatible UI (derived from `dani-garcia/bw_web_builds v2026.10.1`) that runs entirely in the browser. It is accessible via HTTP on port 8080, which is the default port exposed by the container.

Actual

The bundled web vault interface is served directly by the Vaultwarden server from the `/web-vault` directory within the container image. This interface is a prebuilt Bitwarden-compatible UI (derived from `dani-garcia/bw_web_builds v2026.7.0`) that runs entirely in the browser. It is accessible via HTTP on port 8080, which is the default port exposed by the container.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

Returns the Vaultwarden server version as a JSON string, including quotes. Example response body: `"1.37.5"`. This value corresponds to the server binary version.

Actual

Returns the Vaultwarden server version as a JSON string, including quotes. Example response body: `"1.37.4"`. This value corresponds to the server binary version.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* **Response:** Returns the version number as a JSON string (e.g., `"1.37.5"`).

Actual

* **Response:** Returns the version number as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* **`GET /api/version`**: Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.5"`).

Actual

* **`GET /api/version`**: Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* **Response Body:** A bare JSON string containing the version number, for example: `"1.37.5"`. Note that the response includes the quotes and does not include the word "Vaultwarden".

Actual

* **Response Body:** A bare JSON string containing the version number, for example: `"1.37.4"`. Note that the response includes the quotes and does not include the word "Vaultwarden".

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

Vaultwarden is a self-hosted password manager compatible with Bitwarden clients, allowing you to securely store and sync credentials across devices. It eliminates vendor lock-in by running entirely on your own infrastructure with no external database dependencies. This release is based on the upstream project `dani-garcia/vaultwarden` version 1.37.5 (AGPL-3.0-only). The bundled web UI is `dani-garcia/bw_web_builds` version 2026.10.1 (GPL-3.0-only). Both licenses are disclosed, and corresponding source is available per AGPL-3.0 §13 and GPL-3.0.

Actual

Vaultwarden is a self-hosted password manager compatible with Bitwarden clients, allowing you to securely store and sync credentials across devices. It eliminates vendor lock-in by running entirely on your own infrastructure with no external database dependencies. This release is based on the upstream project `dani-garcia/vaultwarden` version 1.37.5 (AGPL-3.0-only). The bundled web UI is `dani-garcia/bw_web_builds` version 2026.7.0 (GPL-3.0-only). Both licenses are disclosed, and corresponding source is available per AGPL-3.0 §13 and GPL-3.0.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

* **Bundled Web UI:** The prebuilt Bitwarden-compatible web vault interface is derived from `dani-garcia/bw_web_builds` (v2026.10.1), which is based on `bitwarden/clients`.

Actual

* **Bundled Web UI:** The prebuilt Bitwarden-compatible web vault interface is derived from `dani-garcia/bw_web_builds` (v2026.7.0), which is based on `bitwarden/clients`.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

* **Web UI Component**: `dani-garcia/bw_web_builds` version 2026.10.1

Actual

* **Web UI Component**: `dani-garcia/bw_web_builds` version 2026.7.0

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.5"`). The response includes the version number in quotes, without the word "Vaultwarden".

Actual

Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.4"`). The response includes the version number in quotes, without the word "Vaultwarden".

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.5"`).

Actual

Returns the Vaultwarden server version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* `GET /api/version`: Returns the version as a JSON string (e.g., `"1.37.5"`).

Actual

* `GET /api/version`: Returns the version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

This instance runs Vaultwarden version 1.37.5, sourced from the upstream project at github.com/dani-garcia/vaultwarden (AGPL-3.0-only). The bundled web UI is dani-garcia/bw_web_builds v2026.10.1 (GPL-3.0-only). The deployment model is a single container image (`readystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1`) that contains the complete running instance. It consists of a Rust (Rocket) server binary (~40MB ELF, dynamically linked against Ubuntu 24.04's OpenSSL 3.0) with embedded SQLite statically compiled in. The container serves a prebuilt Bitwarden-compatible web vault UI from `/web-vault` on disk and manages its own data via embedded SQLite under `/data`, requiring no external database or sidecar services.

Actual

This instance runs Vaultwarden version 1.37.5, sourced from the upstream project at github.com/dani-garcia/vaultwarden (AGPL-3.0-only). The bundled web UI is dani-garcia/bw_web_builds v2026.7.0 (GPL-3.0-only). The deployment model is a single container image (`readystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1`) that contains the complete running instance. It consists of a Rust (Rocket) server binary (~40MB ELF, dynamically linked against Ubuntu 24.04's OpenSSL 3.0) with embedded SQLite statically compiled in. The container serves a prebuilt Bitwarden-compatible web vault UI from `/web-vault` on disk and manages its own data via embedded SQLite under `/data`, requiring no external database or sidecar services.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

This release is based on Vaultwarden 1.37.5, an open-source, Bitwarden-compatible password manager server. The server component is licensed under AGPL-3.0-only, while the bundled web vault UI (dani-garcia/bw_web_builds v2026.10.1) is licensed under GPL-3.0-only. Corresponding source code is available per the terms of these licenses.

Actual

This release is based on Vaultwarden 1.37.5, an open-source, Bitwarden-compatible password manager server. The server component is licensed under AGPL-3.0-only, while the bundled web vault UI (dani-garcia/bw_web_builds v2026.7.0) is licensed under GPL-3.0-only. Corresponding source code is available per the terms of these licenses.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

Returns the server version as a JSON string (e.g., `"1.37.5"`).

Actual

Returns the server version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* **GET /api/version**: Returns the server version as a JSON string (e.g., `"1.37.5"`).

Actual

* **GET /api/version**: Returns the server version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5".

Expected

* `GET /api/version`: Returns the Vaultwarden version as a JSON string (e.g., `"1.37.5"`).

Actual

* `GET /api/version`: Returns the Vaultwarden version as a JSON string (e.g., `"1.37.4"`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The image contains a single Rust binary (`/usr/bin/vaultwarden`) built with the Rocket framework. It is approximately 40MB, dynamically linked against Ubuntu 24.04’s OpenSSL 3.0 (`libssl3t64`), and has embedded SQLite statically compiled in. The server serves a prebuilt Bitwarden-compatible web vault UI from `/web-vault` on disk. The bundled web vault UI is `dani-garcia/bw_web_builds v2026.10.1` (GPL-3.0-only). The server component is `dani-garcia/vaultwarden 1.37.5` (AGPL-3.0-only).

Actual

The image contains a single Rust binary (`/usr/bin/vaultwarden`) built with the Rocket framework. It is approximately 40MB, dynamically linked against Ubuntu 24.04’s OpenSSL 3.0 (`libssl3t64`), and has embedded SQLite statically compiled in. The server serves a prebuilt Bitwarden-compatible web vault UI from `/web-vault` on disk. The bundled web vault UI is `dani-garcia/bw_web_builds v2026.7.0` (GPL-3.0-only). The server component is `dani-garcia/vaultwarden 1.37.5` (AGPL-3.0-only).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

The image also includes the prebuilt web vault UI (derived from `dani-garcia/bw_web_builds v2026.10.1`), which is served from the `/web-vault` directory on disk.

Actual

The image also includes the prebuilt web vault UI (derived from `dani-garcia/bw_web_builds v2026.7.0`), which is served from the `/web-vault` directory on disk.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and the transcript of `vaultwarden --version`).

Expected

This release is based on the upstream project `dani-garcia/vaultwarden` version 1.37.5, licensed under AGPL-3.0-only. The bundled web vault UI is `dani-garcia/bw_web_builds` version 2026.10.1, licensed under GPL-3.0-only. Corresponding source is available per the terms of these licenses.

Actual

This release is based on the upstream project `dani-garcia/vaultwarden` version 1.37.5, licensed under AGPL-3.0-only. The bundled web vault UI is `dani-garcia/bw_web_builds` version 2026.7.0, licensed under GPL-3.0-only. Corresponding source is available per the terms of these licenses.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Misquoted log line (Operating facts, from strategy doc_facts.admin_token). The real message has backticks around ADMIN_TOKEN, so an admin who searches the log for the quoted text finds nothing and concludes no plain-text token is in use. Fix it in doc_facts.admin_token and in the 14 copies listed in the evidence.

Expected

A plain-text value such as -e ADMIN_TOKEN='my new pass $x!' also works, but the log then shows ``[NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure.`` and anyone who can run docker inspect can read it.

Actual

A plain-text value such as -e ADMIN_TOKEN='my new pass $x!' also works, but the log then shows `[NOTICE] You are using a plain text ADMIN_TOKEN which is insecure.` and anyone who can run docker inspect can read it.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

The step says to replace the r1 tag, but no r1 appears in the command; the tag shown is this release, r3.

Expected

2. Start the new container with the new release's tag in place of `1.37.4-CE-ubuntu24.04-r3` in the command below (as shown, it starts this release again), passing the same volume mount and environment variables (including `ADMIN_TOKEN` if it was set):

Actual

2. Start the new container with the new release's tag in place of `1.37.4-CE-ubuntu24.04-r1` in the command below (as shown, it starts this release again), passing the same volume mount and environment variables (including `ADMIN_TOKEN` if it was set):

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

1.37.5-CE-ubuntu24.04-r1

Found by

review

Anyone who can reach the server can create an account until you turn sign-ups off: add -e SIGNUPS_ALLOWED=false on a server whose admin page has never been saved; once the admin page has been saved, that variable is ignored, so switch off Allow new signups in the admin page's General settings and press Save.

Record match

No public record found

Release

1.37.5-CE-ubuntu24.04-r1

Found by

strategy

Live peer addition offered without saying it is not persistent.

Expected

Add a [Peer] section per peer (PublicKey, AllowedIPs, and Endpoint for the side that dials) and restart, or add peers live with `docker exec wireguard wg set wg0 peer <public key> allowed-ips <ip>/32` and `docker exec wireguard netadmin ip route replace <ip>/32 dev wg0`. Live changes are lost at the next restart, so also add the peer to /config/wg0.conf.

Actual

Add a [Peer] section per peer (PublicKey, AllowedIPs, and Endpoint for the side that dials) and restart, or add peers live with `docker exec wireguard wg set wg0 peer <public key> allowed-ips <ip>/32` and `docker exec wireguard netadmin ip route replace <ip>/32 dev wg0`.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

0.0.20250522-CE-ubuntu24.04-r2

Found by

review

Stale superseded release tag r4 in the r5 handbook

Expected

The container is built from `readystack/moodle:v5.3.0-CE-ubuntu24.04-r5`. It runs Apache with PHP as a single foreground process on port 8080. The runtime identity is `www-data` (uid 33, gid 33).

Actual

The container is built from `readystack/moodle:v5.3.0-CE-ubuntu24.04-r4`. It runs Apache with PHP as a single foreground process on port 8080. The runtime identity is `www-data` (uid 33, gid 33).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v5.3.0-CE-ubuntu24.04-r5

Found by

review

Stale superseded release tag r4 in the r5 handbook

Expected

If you do not tag the image and use the tag name `readystack/moodle:v5.3.0-CE-ubuntu24.04-r5` in `docker run` immediately after loading, Docker will attempt to pull that tag from Docker Hub, which will fail on an offline host or will run a previously pulled image under that name instead of your rebuild.

Actual

If you do not tag the image and use the tag name `readystack/moodle:v5.3.0-CE-ubuntu24.04-r4` in `docker run` immediately after loading, Docker will attempt to pull that tag from Docker Hub, which will fail on an offline host or will run a previously pulled image under that name instead of your rebuild.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v5.3.0-CE-ubuntu24.04-r5

Found by

review

Two different thresholds (3.7.9 vs 3.7.0) for the same guidance remain (round-2 finding).

Expected

**Before upgrading from a release older than 3.7.0**, read the Loki upgrade guide (it has no entries for 3.7.x).

Actual

**Before upgrading from a release older than 3.7.9**, read the Loki upgrade guide.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Procedure omits docker stop, so its docker rm fails on a running container.

Expected

copy it out of the old container with `docker cp` before the `docker rm loki` above (the container may be running or stopped), then mount it into the new one; the sequence is `docker cp loki:/etc/loki/config.yaml ./config.yaml`, `docker stop loki`, `docker rm loki`:

Actual

copy it out of the old container with `docker cp` before the `docker stop loki` and `docker rm loki` above, then mount it into the new one:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Suggests restart policies recover an unhealthy container.

Expected

use external monitoring or orchestration that acts on the health status (a Docker restart policy restarts only a container that exits, not one that is unhealthy).

Actual

use external orchestration (such as systemd or Docker Compose with restart policies) if you need automatic recovery.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Names a document as a copy of the script.

Expected

Copies under `docs/offline/` and `docs/docker/` exit immediately with `SOURCE_DATE_EPOCH.txt missing`; always run from the archive root.

Actual

Copies at `docs/REBUILD.md` and elsewhere exit immediately with `SOURCE_DATE_EPOCH.txt missing`; always run from the archive root.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Same ambiguity: 'earlier release' includes r3, which ran as 10001, so the chown instruction is wrong for an r3 volume.

Expected

The runtime user changed from uid 999 (r2 and earlier) to uid 10001 in r3, and r4 keeps uid 10001, so if your data volume was written by r2 or an earlier ReadyStack release, it is owned by uid 999

Actual

The runtime user changed from uid 999 to uid 10001, so if your data volume was written by an earlier ReadyStack release, it is owned by uid 999

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Reads as if r4 changed the user relative to r3, which it supersedes.

Expected

The runtime user changed from uid 999 (r2 and earlier) to uid 10001 in r3; r4 keeps uid 10001.

Actual

The runtime user changed from uid 999 to uid 10001.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Contradicts the r2 special case that follows.

Expected

No migration steps are needed when upgrading from r3; a volume written by r2 or an earlier ReadyStack release needs the one-time chown described below.

Actual

No additional migration steps are required within the 3.7.9 series.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Names the wrong condition for the 404 and contradicts API:1845.

Expected

GET or POST `/loki/api/v1/delete` when the delete API is not enabled (which is the case in the shipped configuration, where `compactor.retention_enabled` is false; setting `delete_request_store` alone does not enable it)

Actual

GET or POST `/loki/api/v1/delete` when the delete API is not enabled (which is the case in the shipped configuration, where `compactor.delete_request_store` is not set)

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

False 'both required' claim.

Expected

`start` and `end` — either may be given on its own (an omitted `end` is the current time).

Actual

`start` and `end` — both required together.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the time range is required; it is optional.

Expected

This endpoint accepts a LogQL selector and an optional time range (the default is the last hour), and returns matching log lines and their timestamps.

Actual

This endpoint accepts a LogQL selector, a required time range, and returns matching log lines and their timestamps.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

The cat-from-image command shows the shipped file, not the effective configuration (same command family as the round-2 findings).

Expected

To print the shipped configuration file that is baked into the image (not the running configuration), run the command below; to see the effective configuration of a running container, including defaults, flags and a mounted file, run `curl -s http://localhost:3100/config`:

Actual

To view the current effective configuration—the shipped file plus any command-line overrides (`-target=all`) and built-in defaults—run:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Contradicts API:1825/1957/2079 and implies a restart is not enough.

Expected

After editing the mounted configuration file, run `docker restart loki` for the change to take effect (re-creating the container with the same mount also works):

Actual

After editing the mounted configuration file, stop the container, remove it, and start a new one with the updated mounted file for changes to take effect:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Contradicts the same section's neighbour and implies a restart does not pick up edits (round-2 'restart' finding family).

Expected

Later edits to the mounted configuration file take effect after `docker restart loki` (re-creating the container also works).

Actual

Later edits to the mounted configuration file take effect after `docker stop loki`, `docker rm loki`, and then `docker run -d --name loki -p 127.0.0.1:3100:3100 -v loki-data:/loki -v $PWD/config.yaml:/etc/loki/config.yaml:ro readystack/loki:v3.7.9-CE-ubuntu24.04-r4`.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Deleting files from a separate volume does not lower usage of the /loki filesystem.

Expected

To free space, either delete other files on the filesystem that holds `/loki` or enlarge that filesystem or volume.

Actual

To free space, either delete log files from a separate volume or enlarge the `/loki` volume itself.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Unsupported absolute claim that contradicts the retention sections.

Expected

with the shipped configuration (retention off) only manual intervention (freeing space or enlarging the volume) allows pushes to resume; with retention enabled the compactor also deletes chunks older than `retention_period` after the 2-hour `retention_delete_delay`.

Actual

retention alone does not free space during the write-guard throttling—only manual intervention (freeing space or enlarging the volume) allows pushes to resume.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Self-contradictory: 'only way is to enlarge the volume' vs 'free space elsewhere on that filesystem'.

Expected

Because retention is off and the delete API is disabled, Loki frees no space itself: free other space on that filesystem or enlarge the volume.

Actual

Because retention is off and the delete API is disabled, the only way to free space on the `/loki` filesystem is to enlarge the volume.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

'Removing the container' deletes logs is wrong for a volume; the absolute 'neither can free space' contradicts the next paragraph.

Expected

Logs are stored indefinitely under `/loki` and are deleted only when you remove the volume (removing the container deletes them only if `/loki` was not on a volume). The log-deletion API is not enabled and returns HTTP 404; with the shipped configuration neither retention nor the delete function frees space when the filesystem fills. If you enable retention, the compactor reclaims space for chunks older than `retention_period` after the 2-hour `retention_delete_delay`.

Actual

Logs are stored indefinitely under `/loki` and are deleted only when you remove the volume or the container. The log-deletion API is not enabled and returns HTTP 404; neither retention nor the delete function can free space when the filesystem fills.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Absolute claim that retention cannot free space contradicts the retention-enabled paragraphs (round-2 finding, not fully removed).

Expected

With the shipped configuration (retention off, delete API answering 404) neither frees space, so pushes resume only when you free other space on that filesystem or enlarge the volume. If you enable retention, the compactor deletes chunks older than `retention_period` (after the 2-hour `retention_delete_delay`), which also reclaims space.

Actual

Neither retention nor the delete API frees space for this guard. Once the filesystem is full enough to trigger the guard, the only ways to resume pushes are to free space on that filesystem (for example, by deleting unrelated files) or to enlarge the volume itself.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Contradicts the other Labels API sections and the measured behaviour (round-2 finding fixed in 1145/1209 but left here).

Expected

If omitted, the endpoint returns the label names Loki currently holds, not only those of the last hour.

Actual

If omitted, the window begins one hour before `end`.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

A Running module is not necessarily ready; /services is Running while /ready is still 503.

Expected

Modules report their lifecycle state (`Running` once started). `ingester => Running` appears within about two seconds of start, before `GET /ready` answers 200, so use `GET /ready` for readiness.

Actual

Modules report their readiness state; a module at state `Running` is ready.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Implies /services reflects readiness and shows Pending/Failed states during startup; measured: all Running long before /ready is 200.

Expected

`GET /services` lists all 16 modules as `Running` within about two seconds of the container starting, well before `GET /ready` answers 200 (the ingester waits about 15 seconds after joining the ring); use `GET /ready`, not `/services`, to decide when Loki accepts pushes and queries.

Actual

All modules must reach `Running` before `GET /ready` answers 200 and the container becomes healthy. During startup, `GET /services` returns the same module list with states such as `Pending` (before startup is complete) or `Failed` (if a component cannot start). Querying or pushing while any module is not `Running` may fail.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

False isolation claim: the host can reach the unpublished container ports on the bridge network.

Expected

Containers on other Docker networks cannot reach them, but the Docker host itself can still reach the container's address on the bridge network (both ports, unauthenticated) without any `-p`; treat every local user on the host as able to reach Loki.

Actual

Containers on other networks or the host cannot reach them (except the host can still reach port 3100 if you publish it with `-p`).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Example log lines show invented caller file:line values.

Expected

level=info ts=2026-11-07T04:34:30.531Z caller=loki.go:615 msg="Loki started" startup_time=348.385708ms

Actual

level=info ts=2026-10-28T12:34:56.789Z caller=loki/main.go:123 msg="Loki started"

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Copy-out step is placed after the container has already been removed.

Expected

A restored container runs the image's shipped configuration. If you have changed `/etc/loki/config.yaml`, copy it out of the old container with `docker cp` before the `docker stop loki` and `docker rm loki` above, then mount it into the new one:

Actual

A restored container runs the image's shipped configuration. If you have changed `/etc/loki/config.yaml`, copy it out of the old container before the restore, then mount it into the new one:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Places the new docker run between stop and rm, which fails with a name conflict.

Expected

(copy the file with `docker cp` after `docker stop loki` but before `docker rm loki`; run the new `docker run` only after `docker rm loki`)

Actual

(after `docker stop loki` but before `docker rm loki`)

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Names a tool that does not report volume usage.

Expected

With retention off, monitor the free space of the filesystem holding the volume (for example `df` on the Docker host) and add capacity before it reaches 80–85%.

Actual

With retention off, monitor the volume usage with `docker stats` and add capacity before it reaches 80–85%.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

The same guidance gives three different version thresholds (3.7.9, 3.7.8, 3.7.0).

Expected

Before upgrading from a release older than 3.7.9, read the upgrade guide for every version between your current release and 3.7.9 to check for breaking changes.

Actual

Before upgrading from a release older than 3.7.8, read the upgrade guide for every version between your current release and 3.7.9 to check for breaking changes.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Absolute claim that no configuration change reclaims space contradicts the retention section.

Expected

With the shipped configuration retention is off, so nothing in Loki reclaims space; enabling retention (see Retention and Deletion) lets the compactor delete old chunks.

Actual

Nothing you do in Loki—no configuration change, no API call—will reclaim space.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

States logs are removed after about 15 minutes; the effective delay is 2 h or more.

Expected

The compactor runs every 10 minutes and deletes chunks marked for retention after the 2-hour retention_delete_delay, so space is freed a couple of hours after logs pass `retention_period`.

Actual

After the next compaction cycle (approximately 15 minutes), logs older than `retention_period` are removed, freeing space.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says no health check runs for 25 s; checks run every 5 s and only their failures are ignored during the start period.

Expected

with a 25-second start period during which failed checks are not counted as unhealthy

Actual

with a 25-second grace period before the first health check runs

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the container is healthy throughout startup; it is "starting".

Expected

so the container shows `health: starting` during startup and becomes `healthy` once /ready answers 200.

Actual

so the container remains in a `healthy` state throughout startup.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Same false "all three required or exit" claim in the API guide.

Expected

Omitting `compactor.delete_request_store` causes Loki to exit at start; omitting `limits_config.retention_period` does not (it starts with retention_period 0s, so nothing is deleted).

Actual

All three are required; omitting any one causes Loki to exit at start.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says omitting any of the three retention settings makes Loki exit; omitting retention_period does not.

Expected

Without `compactor.delete_request_store` (or with `retention_period` under `compactor`), Loki exits at startup; without `limits_config.retention_period` it starts and keeps logs indefinitely.

Actual

Without all three, Loki exits at startup.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Lists push under "HTTP 200"; it returns 204.

Expected

- POST `/loki/api/v1/push` returns HTTP 204 (not 200) when a log line is successfully ingested; the response body is empty

Actual

- POST `/loki/api/v1/push` when a log line is successfully ingested (the response body is empty)

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Labels default window is stated as the last hour (API:1118, 1145, 1209) while API:1168 says all stored logs; measured: not time-filtered.

Expected

If no `start` and `end` parameters are given, the endpoint returns the label names Loki currently holds.

Actual

If no `start` and `end` parameters are given, the endpoint reads label names from the last hour of logs.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Same mislabelled example.

Expected

Example: to list labels present in a fixed window, use (replace the dates with your own):

Actual

Example: to list labels present only in the last 24 hours, use:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Example labelled "last 24 hours" uses fixed past dates.

Expected

Example query for labels in a fixed window (replace the dates with your own):

Actual

Example query for labels in the last 24 hours:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Claims query_range returns no data key for an empty window; it returns data.result as an empty array, and data is an object, not an array.

Expected

or if the query's time window contains no logs, the response is `success` with `data.result` as an empty array. After logs have been pushed, `data.result` holds one entry per matching stream.

Actual

or if the query's time window contains no logs, the response status is `success` with no `data` key. After logs have been pushed, the response includes a `data` array of matching entries under each label combination (or stream).

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

States the opposite of the rest of the handbook about where the "Ingester not ready" text appears.

Expected

These strings are the body of the 503 response from `/ready`; they do not appear in `docker logs`.

Actual

These are logged to stderr and appear in `docker logs`, but they do NOT appear as the response body of `/ready` requests. The actual HTTP response during startup is 503 Service Unavailable.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says every release before r4 ran as uid 999; r3 ran as uid 10001.

Expected

if you migrate a volume from v3.7.9-CE-ubuntu24.04-r2 or an earlier ReadyStack Loki release (which ran as uid 999)

Actual

if you migrate a volume from a ReadyStack Loki release before v3.7.9-CE-ubuntu24.04-r4 (which ran as uid 999)

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the release replaces r2.

Expected

This release (v3.7.9-CE-ubuntu24.04-r4) supersedes v3.7.9-CE-ubuntu24.04-r3 with the same Loki version and settings;

Actual

This release (v3.7.9-CE-ubuntu24.04-r4) replaces v3.7.9-CE-ubuntu24.04-r2 with the same Loki version and settings;

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the release replaces r2.

Expected

This release (Loki 3.7.9) has the same settings, ports, and data paths as v3.7.9-CE-ubuntu24.04-r2 and -r3; it supersedes r3.

Actual

This release (Loki 3.7.9) has the same settings, ports, and data paths as v3.7.9-CE-ubuntu24.04-r2, which it replaces.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the release replaces r2.

Expected

This release (Loki 3.7.9) and the v3.7.9-CE-ubuntu24.04-r2 and -r3 releases have the same HTTP ports

Actual

This release (Loki 3.7.9) and the v3.7.9-CE-ubuntu24.04-r2 it replaces have the same HTTP ports

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

r2 called "the prior release".

Expected

If you are upgrading from v3.7.9-CE-ubuntu24.04-r2 (or earlier), its runtime user was uid 999; the previous release, r3, already ran as uid 10001.

Actual

If you are upgrading from the prior release (v3.7.9-CE-ubuntu24.04-r2), its runtime user was uid 999.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

This release is said to replace r2; it supersedes r3 (round-1 fix incomplete).

Expected

This release (Loki 3.7.9 in the r4 build) supersedes v3.7.9-CE-ubuntu24.04-r3 and has the same ports, settings, and data paths as r2 and r3.

Actual

This release (Loki 3.7.9 in the r4 build) replaces v3.7.9-CE-ubuntu24.04-r2 and has the same ports, settings, and data paths.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Self-contradictory: r3 volumes are said to be owned by uid 999.

Expected

If your /loki volume was created by r2 or an earlier ReadyStack release, the volume's files are owned by uid 999 and must be changed to uid 10001 before this release starts on it; a volume written by r3 is already owned by uid 10001.

Actual

If your /loki volume was created by that earlier release or any other ReadyStack release, the volume's files are owned by uid 999 and must be changed to uid 10001 before this release starts on it.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Same uid-10001-to-10001 contradiction in the DB handbook.

Expected

If you mount a volume created by v3.7.9-CE-ubuntu24.04-r2 or an earlier ReadyStack release of this image (which ran as uid 999), you must change its ownership to 10001:10001 as root on the Docker host before starting this release:

Actual

If you mount a volume created by an earlier ReadyStack release of this image that ran as uid 10001, you must change its ownership to 10001:10001 as root on the Docker host before starting this release:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Earlier release described as running as uid 10001 while telling the customer to chown to 10001.

Expected

If you migrate data from v3.7.9-CE-ubuntu24.04-r2 or an earlier ReadyStack release that ran as uid 999, you must change ownership to 10001:10001 as root on the Docker host before starting this release:

Actual

If you migrate data from an earlier ReadyStack release that ran as uid 10001, you must change ownership to 10001:10001 as root on the Docker host before starting this release:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the earlier release ran as uid 10001 and must be chowned to 10001, contradicting every other section (r2 ran as uid 999).

Expected

If you are reusing a volume from v3.7.9-CE-ubuntu24.04-r2 or an earlier ReadyStack release (which ran as uid 999), you must change its ownership to uid 10001 as root on the Docker host before starting this version:

Actual

If you are reusing a volume from an earlier ReadyStack release (which ran as uid 10001), you must change its ownership to uid 10001 as root on the Docker host before starting this version:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Copy-out step for a changed configuration reads the shipped file from the image.

Expected

1. Copy it out of the old container before removing it: `docker cp loki:/etc/loki/config.yaml ./config.yaml`

Actual

1. Copy it out: `docker run --rm --entrypoint cat -v loki-data:/loki readystack/loki:v3.7.9-CE-ubuntu24.04-r4 /etc/loki/config.yaml > config.yaml`

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Copy-out command for a modified configuration reads the shipped file from the image, not the old container.

Expected

docker cp loki:/etc/loki/config.yaml ./config.yaml

Actual

docker run --rm --entrypoint cat -v loki-data:/loki readystack/loki:v3.7.9-CE-ubuntu24.04-r4 /etc/loki/config.yaml > config.yaml

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Tells the customer to save their edited configuration with the cat-from-image command (which yields the shipped default) and says a mounted file is not preserved by docker restart (it is).

Expected

keep the edited configuration file you mounted (or copy it out of the old container with `docker cp loki:/etc/loki/config.yaml ./config.yaml`) so you can mount it again into the new container.

Actual

save your edited configuration file first using the `docker run --entrypoint cat` command above, so you can mount it again into the new container.

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

Says the cat-from-image command extracts the current configuration from the old container; it extracts the shipped default and overwrites an edited config.yaml, so retention silently turns off after the restore.

Expected

To save the configuration the old container is running (including a file you mounted over it), copy it out of that container before removing it with `docker cp loki:/etc/loki/config.yaml ./config.yaml`. (`docker run --rm --entrypoint cat <image> /etc/loki/config.yaml` prints the image's shipped file, not the old container's.)

Actual

To extract the current configuration from the old container before removing it, use:

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review

The Unix-seconds example uses the same instant for start and end, so a copy-pasted query silently returns no logs (round-1 fix incomplete).

Expected

- Unix seconds: `--data-urlencode "start=$(date -d '1 hour ago' +%s)" --data-urlencode "end=$(date +%s)"`

Actual

- Unix seconds: `--data-urlencode "start=$(date +%s)" --data-urlencode "end=$(date +%s)"`

Resolution

Found before release and fixed before it shipped.

Record match

No public record applies

Release

v3.7.9-CE-ubuntu24.04-r4

Found by

review