20260416 Weekly Development Meeting

[josecelano]

• Time:

  • 09:30 in Canary Islands (WET / UTC+0)
  • 10:30 in Vaduz (CET / UTC+1)

• Location:
  https://meeting.blockfinance-eco.li/nautiluscyberneeringweeklydevmeeting

• Expected Duration: 2 to 4 hours, including breaks

• Confirmed Attendees:

  • Cameron Garnham (@da2ce7)
  • Constantin Bosse (@cgbosse)
  • Jose Celano (@josecelano)

---

Agenda

1. Weekly Updates (Each participant will take a turn)

Each team member should come prepared with comments added in advance to this discussion. During their turn, they will:

• Review their notes/comments and provide a summary of:
  • Issues worked on
  • Progress made
  • Other relevant tasks completed
• Share any challenges faced and request assistance if needed
• Highlight any difficulties that may risk delays or affect the final product's quality
• Outline their planned tasks for the upcoming week
• Mention any new technical topics they've noted for potential future discussion (to be added as comments in this thread)

🔁 This format ensures everyone follows a structured sequence during the meeting.

2. Technical Discussion Planning

After all updates:

• Any proposed technical topics will be reviewed
• A decision will be made on whether to:
  • Schedule a follow-up technical meeting, or
  • Continue with the discussion immediately, time permitting
• The attendees for the follow-up meeting will be determined, allowing others to resume their work as needed

[josecelano]

This week, I've been mainly focused on finishing tasks (especially updating dependencies to fix security issues) to release the Torrust Tracker Deployer version 0.1.0.

I have also resized the Hetzner VM hosting the tracker demo becuase the UDP tracker uptime went below 95%.

Torrust Tracker

PR review:

• feat: add PostgreSQL database driver torrust/torrust-tracker#1684

Torrust Tracker Deployer

Implemented issues:

• Analyze and remediate Docker image vulnerabilities from April 8, 2026 scan torrust/torrust-tracker-deployer#428
• fix(ci): restore third-party Trivy SARIF uploads (GitHub API rejects category field) torrust/torrust-tracker-deployer#437
• Automate Cargo Audit Security Scanning and Dependency Remediation torrust/torrust-tracker-deployer#439
• chore: add update-dependencies.sh automation script torrust/torrust-tracker-deployer#446
• Define a simple release process for branch/tag/docker/crate publication torrust/torrust-tracker-deployer#448
• Release v0.1.0-beta.1: End-to-End Process Validation torrust/torrust-tracker-deployer#450
• Release v0.1.0: Stable End-to-End Execution torrust/torrust-tracker-deployer#462

Merged PRs:

• docs: refresh README for 0.1.0 release torrust/torrust-tracker-deployer#441
• Track Cargo.lock for reproducible app builds torrust/torrust-tracker-deployer#442
• refactor: [#450] rename internal crates for tracker deployer namespace torrust/torrust-tracker-deployer#452
• chore: [#434] upgrade Grafana to 13.0.0 and document CVE-2026-34986 analysis torrust/torrust-tracker-deployer#453
• chore: [#432] upgrade Caddy to 2.11.2 and document CVE analysis torrust/torrust-tracker-deployer#455
• docs: [#435] document mysql:8.4 CVE analysis and accepted risk torrust/torrust-tracker-deployer#456
• docs: [#431] document backup image CVE analysis and accepted risk torrust/torrust-tracker-deployer#457
• docs: [#429] document deployer scan pass-2 - CRITICAL pending OpenTofu upstream torrust/torrust-tracker-deployer#458
• chore: update dependencies torrust/torrust-tracker-deployer#461

Newly opened issues:

• chore: update GitHub Actions to Node.js 24 compatible versions torrust/torrust-tracker-deployer#460

Torrust Tracker Demo

Implemented issues:

• docs: add recurring security review plan torrust/torrust-tracker-demo#13
• chore: update Docker images for security vulnerability fixes torrust/torrust-tracker-demo#14
• Follow-up: migrate deployed demo server to MySQL DSN env override (remove DSN from tracker.toml) torrust/torrust-tracker-demo#17
• docs: research low UDP tracker uptime on newTrackon torrust/torrust-tracker-demo#19

PRs:

• feat(copilot): add proactive committer workflow torrust/torrust-tracker-demo#16

Torrust Webiste

New article:

• How to Run a UDP Tracker Behind a Floating IP on Ubuntu

Maintenance tasks:

• chore: update dependencies including major upgrades torrust/torrust-website#189 (update dependencies)

NOTE: Time spent on Torrust ~28.5h