Skip to content

Ririko 2.1.2

Latest
Latest

Choose a tag to compare

View all tags
@earnestangel earnestangel released this 26 Oct 14:11
v2.1.2
81f512f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ririko 2.1.2 is a security update. It protects Lavalink from the compromised eMudhra certificate authorities, updates the dashboard to Next.js 16.4.3, and makes the /profile card readable.

Security

  • eMudhra CA compromise (CVE-2026-111943): the private keys of eight eMudhra intermediate CAs can be recovered from their certificates, so whoever holds one can pose as any website. The Java inside the Lavalink image (Temurin 18, end of life) still trusted them. Both compose files now give Lavalink Java's updated list of blocked certificates (blocked.certs, the same file that Amazon Corretto 17.0.21 and SapMachine 21.0.13.0.2 ship). The Lavalink image, application.yml and the music plugins do not change (BUG-0055).
  • Dashboard: Next.js 16.3.8 is updated to 16.4.3. This fixes two critical advisories (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and a Server Actions denial of service (GHSA-p3m5-59mp-jv5r) (BUG-0055).
  • Node2Shell (CVE-2026-111497): the bot and dashboard images already run Node.js 22.23.4, which fixes it and also distrusts the eMudhra CAs. The images have done so since 2.0.2, and they also carry Debian's fixed ca-certificates. If you run Ririko from source, update Node.js to 22.23.4 or newer.

Fixes

  • Profile card: /profile is readable at the size Discord shows it. The icons are drawn instead of showing as empty boxes, the equipped Waifu TCG card is shown (set it with /card action:equip), the name is your server nickname, and a custom background is cropped instead of stretched (BUG-0054).

What you need to do

  • Docker Compose 2.24.4 or newer is now needed: the compose file gives Lavalink its certificate list inline. Check with docker compose version.
  • Pulling and restarting recreates the Lavalink container, so music stops for a few seconds and then works again.

Database

No database changes in this release.

Update

If your compose file uses ririkoai/ririkobot:2 (the default), download the new docker-compose.production.yml of this release, then run:

docker compose -f docker-compose.production.yml --env-file .env.production pull
docker compose -f docker-compose.production.yml --env-file .env.production up -d

Docker images

  • Bot: ririkoai/ririkobot:2.1.2, 2.1 and 2
  • Dashboard: ririkoai/ririkobot-dashboard:2.1.2, 2.1 and 2

Full Changelog: v2.1.1...v2.1.2

Assets 2
Loading