[truecharts-admin]

This PR contains the following updates:

Package	Update	Change
BookStackApp/BookStack	patch	26.09.2 → 26.09.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

BookStackApp/BookStack

v26.09.3: BookStack v26.09.3

Compare Source

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
• Page editor personal draft content could be made visible to other users in certain scenarios.
• On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
• Attachment endpoints could indicate existence of non-accessible pages.

Updating is advised if any of the above scenarios are a concern to your use-case.

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• CayCon (Reporter), VulnCheck (Coordinator)
• Tanna Zu (GitHub)
• Dickson Wu (SEAL & CertiK)
• Zeng Yu
• Efe Çam
• dracaryxxd

Full List of Changes

• Updated application PHP package versions
• Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
• Updated image fetching to fully check access via page access, considering draft and trashed status.
• Updated revision diffing to filter on revision type.
• Updated chapter/book conversion to properly handle child items which are in the recycle bin.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Chores
  • Updated the BookStack image version from 26.09.2 to 26.09.3.

The BookStack Docker Bake configuration now uses 26.09.3 as its default version instead of 26.09.2.

Changes: BookStack version update

Layer / File(s)	Summary
Update BookStack version apps/bookstack/docker-bake.hcl	The default VERSION changes from 26.09.2 to 26.09.3.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested labels: area/apps

Merge Risk: Minimal · up to 5139b

This is a routine BookStack patch release bump that includes upstream security fixes. No merge-blocking risk remains.

Architecture risk: Low · up to 5139b

The change affects 1 system.

Changed systems: apps/bookstack

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — apps/bookstack (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in apps/bookstack/docker-bake.hcl: The VERSION default changes from 26.09.2 to 26.09.3.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the BookStack dependency update from v26.09.2 to v26.09.3.
Description check		The description directly explains the BookStack version update and includes relevant release and security details.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9d7cdf15-9a4e-4bce-b657-3ef96957e48d

Commits

Reviewing files that changed from the base of the PR and between 9c8596c and 5139bfe.

Files selected for processing: 1

• apps/bookstack/docker-bake.hcl

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

[trueforge-bot]

📦 App Size Analysis

Note

Comparing ghcr.io/trueforge-org/bookstack:rolling ➔ ghcr.io/trueforge-org/bookstack:sandbox

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	612.98 MB	613.89 MB	+914.19 kB (+0.15%)	🔼
linux/arm64	311.61 MB	312.59 MB	+979.9 kB (+0.31%)	🔼

[Crow-Control]

Auto approved automated PR