Running image is ghcr.io/9001/copyparty-ac:latest → image 2284b21e4259, built 2026-09-19, version
1.20.24 (image label). This is the one Dankserver container whose fix is both published and pullable
today — every other mutable-tag container either has no advisory or no published fix.
Action: pull and pin ghcr.io/9001/copyparty-ac:1.20.26@sha256:… in the quadlet manifest, restart the
container, confirm the served version.
**Severity:** medium + low, both patched upstream.
| CVE / GHSA | Severity | Fixed in |
|---|---|---|
| [GHSA-3c88-p299-7hvr](https://github.com/9001/copyparty/security/advisories/GHSA-3c88-p299-7hvr) | medium | 1.20.25 |
| [GHSA-hg99-jqfp-rf76](https://github.com/9001/copyparty/security/advisories/GHSA-hg99-jqfp-rf76) | low | 1.20.26 |
Running image is `ghcr.io/9001/copyparty-ac:latest` → image `2284b21e4259`, built 2026-09-19, version
1.20.24 (image label). This is the one Dankserver container whose fix is both published *and* pullable
today — every other mutable-tag container either has no advisory or no published fix.
**Action:** pull and pin `ghcr.io/9001/copyparty-ac:1.20.26@sha256:…` in the quadlet manifest, restart the
container, confirm the served version.
Source: [vuln-dankserver.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankserver.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Pinned and deploying: copyparty unit now carries latest@sha256:7f774591..., whose config label is 1.20.26 - upstream stopped publishing version tags after 1.19.15, so the digest pin is the only honest coordinate. Closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76 once the Dankserver deploy recreates the container; verification = the served version after the drain.
Pinned and deploying: copyparty unit now carries `latest@sha256:7f774591...`, whose config label is `1.20.26` - upstream stopped publishing version tags after 1.19.15, so the digest pin is the only honest coordinate. Closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76 once the Dankserver deploy recreates the container; verification = the served version after the drain.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium + low, both patched upstream.
Running image is
ghcr.io/9001/copyparty-ac:latest→ image2284b21e4259, built 2026-09-19, version1.20.24 (image label). This is the one Dankserver container whose fix is both published and pullable
today — every other mutable-tag container either has no advisory or no published fix.
Action: pull and pin
ghcr.io/9001/copyparty-ac:1.20.26@sha256:…in the quadlet manifest, restart thecontainer, confirm the served version.
Source: vuln-dankserver.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Bump
copypartyto1.20.26pinned in the quadlet manifest and restart - the one pullable fix on Dankserver.Pinned and deploying: copyparty unit now carries
latest@sha256:7f774591..., whose config label is1.20.26- upstream stopped publishing version tags after 1.19.15, so the digest pin is the only honest coordinate. Closes GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76 once the Dankserver deploy recreates the container; verification = the served version after the drain.