GH#85: Upgrade Buzz to desktop-v0.5.23

[marcusquinn]

Summary

• upgrade the Cloudron package from Buzz desktop-v0.5.18 to desktop-v0.5.23
• pin and verify the exact upstream release commit, image revision, multi-platform image digest, and Linux/amd64 manifest
• retain the existing MinIO releases and digests while switching their unavailable Docker Hub source paths to the official Quay repositories
• bump the Cloudron package to 0.1.20 and align release notes, security support metadata, notices, and assertions

Verification

• ./test/package-test.sh
• ./test/verify-buzz-image.sh
• docker build --tag cloudron-buzz-app:test .
• ./test/pairing-proxy-test.sh cloudron-buzz-app:test
• cloudron-package-helper.sh check-release v0.1.20
• linters-local.sh --changed

Runtime Testing

• Built the complete linux/amd64 Cloudron image from the pinned sources.
• Verified the built image's main route returns 200, pairing POST guard returns 403, and exact pairing WebSocket route returns 101.

Release note

Merging this package-version change to main activates the repository's automated image and catalog publication workflow.

Resolves #85

---

aidevops.sh v3.32.367 plugin for OpenCode v1.18.30 with gpt-5.6-sol spent 3h 51m and 716,414 tokens on this with the user in an interactive session. Overall, 3h 17m since this issue was created.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cb11f7b7-3ef9-4e9c-902b-5c3682510bae

📥 Commits

Reviewing files that changed from the base of the PR and between 8708172 and e788225.

📒 Files selected for processing (8)

• CHANGELOG
• CHANGELOG.md
• CloudronManifest.json
• Dockerfile
• SECURITY.md
• THIRD_PARTY_NOTICES.md
• test/package-test.sh
• test/verify-buzz-image.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The package version changes to 0.1.20 with Buzz upstream version 0.5.23. The Buzz image and provenance pins are updated. MinIO references move to Quay with unchanged digests. Documentation and package tests reflect these values.

Changes

Buzz package release

Layer / File(s)	Summary
Release metadata CHANGELOG, CHANGELOG.md, CloudronManifest.json, SECURITY.md	The package version changes to 0.1.20. The upstream version changes to 0.5.23. Release and supported-version records document the update.
Image provenance and registries Dockerfile, THIRD_PARTY_NOTICES.md, test/verify-buzz-image.sh	Buzz pins change to desktop-v0.5.23 and its new image metadata. MinIO references change to official Quay paths while retaining their tags and digests.
Package verification test/package-test.sh	Assertions now check the new package and upstream versions, Buzz provenance values, and Quay-hosted MinIO references.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to e7882

The Buzz 0.5.23 package metadata and pinned MinIO images are aligned, with no confirmed merge-blocking issue.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (6 skipped: 6 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #85 requires the package update to upstream Buzz v0.5.23, coupled metadata updates, verification updates, and the release check before a tag. The PR updates CloudronManifest.json to package 0.1.…
Out of Scope Changes check	✅ Passed	The reported changes are limited to the paths listed in issue #85 and their coupled verification metadata. The MinIO registry-path changes retain the existing releases and digests and are reflected co…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: upgrading Buzz to desktop-v0.5.23. It matches the pull request objectives and changeset.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/auto-20260913-213714

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[marcusquinn]

Completion Summary

• What: Upgrade Buzz for Cloudron to package 0.1.20 / upstream desktop-v0.5.23, with immutable provenance pins and available official MinIO registry paths.
• Issue: Buzz upstream v0.5.23 is available #85
• Files changed: CloudronManifest.json, Dockerfile, changelogs, security metadata, third-party notices, and package verification scripts.
• Testing: Package tests, upstream image verification, complete Docker build, pairing-proxy runtime test, release validation, and changed-file linters pass.
• Key decisions: Preserve the exact MinIO releases and platform digests while switching from unavailable Docker Hub repositories to official Quay repositories.

---

aidevops.sh v3.32.367 plugin for OpenCode v1.18.30 with gpt-5.6-sol spent 3h 51m and 716,414 tokens on this with the user in an interactive session. Overall, 3h 17m since this issue was created.

[marcusquinn]

Release published

• Package: 0.1.20
• Upstream Buzz: 0.5.23
• Release: https://github.com/marcusquinn/cloudron-buzz-app/releases/tag/v0.1.20
• Workflow: https://github.com/marcusquinn/cloudron-buzz-app/actions/runs/34782380578
• Image: ghcr.io/marcusquinn/cloudron-buzz-app:0.1.20@sha256:1b8830e9a6a96d48c11bd95f44a5c77734343f3f20fbe55428a0ecfe09ffebee

The public catalog reports this entry as published, and the image, catalog attestation, release tag, and direct catalog-only child commit were independently verified. An aidevops lifecycle-receipt parser rejected Cloudron's valid tag-and-digest image form after publication; that bookkeeping-only gap is tracked in marcusquinn/aidevops#31862 and does not affect update availability.

---

aidevops.sh v3.32.367 plugin for OpenCode v1.18.30 with gpt-5.6-sol spent 4h 10m and 822,599 tokens on this with the user in an interactive session. Solved in 3h 35m.