26.10.1

This is a security-focused patch. It addresses the eMudhra Intermediate CA compromise, and it also includes two configuration fixes and one change to vroom that you'll want to know about. The ClickHouse image is the one remaining unpatched image. It depends on upstream Altinity publishing a patched image, so we're tracking that and will ship the update as soon as it's available.

Changes to Check

• vroom now uses Distroless by default: The vroom image is now built on Distroless, which strips out package managers, shells, and other components a running service doesn't need. That shrinks the attack surface, which is the main reason for the switch. Check that nothing in your setup depends on a shell being present inside that container.
• SENTRY_BUCKET_PROFILES on vroom: This environment variable needs the http:// scheme included in its value. Without it, the setting doesn't behave as expected. If you set this variable, make sure the scheme is present.
• Uptime checker region config: If you're using the uptime monitoring feature, you need to configure the uptime checker regions in sentry/sentry.conf.py. This one matters if uptime monitoring is part of your setup, so please don't skip it.
• As a result of the certificate changes, SETUP_CUSTOM_CA_CERTIFICATE=1 users must re-run ./install.sh.
• Symbolicator base images have moved to Debian 13

Nothing else in this release is notable. It's a focused patch.

---

We're always happy to chat. If you run into a problem during the upgrade, or just want to talk through your setup, reach out to us on Discord.

Bug Fixes 🐛

• (scripts) Backup never shut down the compose stack by @aldy505 in #4565
• (sentry) Use the env var name gRPC reads for the CA bundle by @geoffg-sentry with @sentry-junior in #4596
• (uptime) Configure uptime-checker API endpoint for Test Monitor and assertion validation by @ayoubjemai in #4583
• (vroom) Add the scheme to the SeaweedFS endpoint in SENTRY_BUCKET_PROFILES by @oioki in #4573

Internal Changes 🔧

Deps

• Bump j178/prek-action from 3.0.1 to 3.1.0 by @dependabot in #4588
• Bump uv to 0.13.5 by @geoffg-sentry with @sentry-junior in #4598
• Bump seaweedfs to 4.51 by @geoffg-sentry with @sentry-junior in #4595
• Bump valkey to 8.1.11-alpine by @geoffg-sentry with @sentry-junior in #4594
• Bump getsentry/craft from 2 to 3 by @dependabot in #4590
• Bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot in #4572
• Bump astral-sh/setup-uv from 10.3.0 to 10.3.2 by @dependabot in #4587
• Bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot in #4589
• Bump urllib3 from 2.7.0 to 2.8.0 by @dependabot in #4550
• Bump nginx from 1.31.7-alpine to 1.31.8-alpine by @dependabot in #4591
• Bump getsentry/coverage-action from 0.4.2 to 0.4.4 by @dependabot in #4571
• Bump edoburu/pgbouncer from v1.26.0-p0 to v1.26.1-p0 by @dependabot in #4584
• Bump nginx from 1.31.6-alpine to 1.31.7-alpine by @dependabot in #4570
• Bump uv to 0.13.4 by @geoffg-sentry with @sentry-junior in #4579
• Bump certifi to 2026.10.19 by @geoffg-sentry with @sentry-junior in #4574
• Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 by @dependabot in #4558
• Bump j178/prek-action from 3.0.0 to 3.0.1 by @dependabot in #4559
• Bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot in #4560