[sentry-junior]

The pinned chrislusf/seaweedfs:4.40_large_disk image is affected by both issues tracked in VULN-3216:

• brotli-libs 1.2.0-r1 is vulnerable to CVE-2026-111497. Alpine 3.24 fixes it in 1.2.1-r0.
• ca-certificates-bundle 20260611-r0 still trusts the compromised eMudhra emSign ECC Root CA - G3 root. Alpine fixes it in 20261020-r0.

4.51_large_disk (digest sha256:f44a1d38…) ships both fixed packages. I checked this by pulling the image and inspecting the apk db and the CA bundle.

• docker-compose.yml: 4.40_large_disk@sha256:d07aa1da… → 4.51_large_disk@sha256:f44a1d38…, still pinned by digest
• docker-compose.yml and install/migrate-seaweedfs-kek.sh: add -master.telemetry=false (see below)

That spans 11 upstream releases. Their release notes for 4.41–4.51 call out no breaking or migration changes, but 4.41 turned on anonymous cluster telemetry by default (seaweedfs/seaweedfs#10488). This PR turns it off on the weed mini service and on the temporary weed server master that the KEK migration starts. Both subcommands accept the flag in 4.51, and weed mini with it set still passes the master and S3 health checks.

Applies to fresh installs and upgrades. The integration tests, which exercise the S3 nodestore and profiles buckets, are the functional check.

via Geoff Goldsmith.

--

View Junior Session [Sentry]

[linear-code]

VULN-3216

[github-actions]

Coverage Results 📊

✅ 22 passed | Total: 22 | Pass Rate: 100% | Execution Time: 9m 55s

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	—
Failed Tests	—
Skipped Tests	—

✨ Test counts unchanged from base.

All tests are passing successfully.

✅ Patch coverage is 100.00% (no changed executable lines found; target 50%).
Project statement coverage is 95.58% (unchanged from base (dd77a9f) to head (75bc282)).

Coverage diff

@@            Coverage Diff             @@
##        master     #4595       +/-##
==========================================
  Coverage    95.58%    95.58%        —%
==========================================
  Files            5         5         —
  Tracked lines       339       339         —
  Branches         0         0         —
==========================================
  Hits           324       324         —
  Misses          15        15         —
  Partials         0         0         —

---

Generated by Coverage Action

[aminvakil]

A minor issue though:

seaweedfs/seaweedfs#10488 which is included since 4.41 enables telemetry by default, I do not know the circumstances and if this should be mentioned explicitly in release notes or not.
It can be disabled by adding -master.telemetry=false to seaweedfs command.

[other-geoffrey]

A minor issue though:

seaweedfs/seaweedfs#10488 which is included since 4.41 enables telemetry by default, I do not know the circumstances and if this should be mentioned explicitly in release notes or not. It can be disabled by adding -master.telemetry=false to seaweedfs command.

Good catch, thank you. Disabling it for now to keep the old defaults

[aldy505]

Honestly I'm not really confident with current SeaweedFS version, as there are so many bugs on it. I even filed an issue here: seaweedfs/seaweedfs#12119

There is also this issue: seaweedfs/seaweedfs#12145