PrivateBin 2.0.4 release coordination

[elrido]

We have had a good run with releases last year, but for various reasons seem to have stalled a bit to get our latest 2.0.4 out of the door. It's mostly bug fixes and updated 3rd part libraries, but also adds to new translations with Swedish and Persian. We got a bit side-tracked with the zlib library refactor, but at least got that to a point where we can get that library finally upgraded, too.

Here is the list of open pull requests that relate to the next release:

• DOMpurify library update
• zlib library update (and forward porting some of our changes back to the library)
• upgrade our container images to PHP 8.5 (to be merged after the release, so we can offer sets of images on PHP 8.4 and 8.5)

Other ongoing or pending work that I'm aware of, not tied to or blocking the release:

• removing the jQuery library dependency (this will require a minor version upgrade, so likely get into a 2.1.0 release)
• cleanup the zlib-wasm project, improve the docs and get it published as an npm package
• resolve the issue with removing attachments (not sure if work on this has started yet)

@rugk, @Ribas160, @karthikkasturi & @r4sas - I'd appreciate your help in getting the open pull requests reviewed and re-reviewed after changes, so we can maybe use one of the longer weekends in May to finally get this release out of the door. I think we are close, but due to current time constraints of @rugk and myself progress seems slower than it could otherwise be. I feel that with 3-4 releases a year we could keep the momentum of the project, which will also draw new contributions and hopefully reduce the load on each of our shoulders.

[rugk]

Yup my priority is getting rid of query right now and also that takes time. In the meantime a minor release can surely be done.

[elrido]

FYI: Release got cut and images on PHP 8.4 built and pushed, but with the PHP 8.5 ones we are now hitting the docker hub rate limits for pulling the alpine 3.23 base images, so have to retry after the 6h cooldown. Is this a new limit with docker hub or were we just lucky never to run into this so far?

This also prevents the pelican website getting rebuilt with latest API & code coverage reports. But the demo website did get upgraded to the 2.0.4 release using the PHP 8.4 based image, which got built before our github CI/CD got rate limited. I'll try to conclude this tonight.

[rugk]

See https://docs.docker.com/docker-hub/usage/

If we are unauthenticated Docker has quite strict rate limits and yes this is quite new since 2025. That's why many people switched to different registries…
But IIRC this should not apply to FLOSS projects (respectively they are exempt). But one needs to be logged in for that, of course.

[elrido]

We do need to be authenticated, since this will afterwards push the release: https://github.com/PrivateBin/docker-nginx-fpm-alpine/blob/02daea059bdb3082552956ffe145f280d48ae6ea/.github/workflows/build-images.yml#L32-L37

The credentials are those of our FOSS-sponsorship account. It seems even that has (now) a rate limit. To be fair, we build multi-arch images over 7 archs in 5 variants from 2 project, which means a single release requires 70 pulls of the alpine-base image. This time we doubled that and while the first release with PHP 8.4 passed, we started getting into the limit with the second set, so possibly after around 90-100 pulls total?

The nginx + fpm ones are all done now and also most of the nginx unit ones. For the pelican image I resorted to use a different build image, but still using the community nginx base for the service. The build image only needs a recent pelican to generate the static pages.

Info and demo pages are up-to-date and the release is nearly concluded.

[elrido]

All done, thanks! I'll close this as resolved, but of course feel free to add any feedback here or in the release discussion.