Release 2026-01-13

drupal/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: drupal
-version: 1.28.2
+version: 1.28.3
 dependencies:
 - name: mariadb
   version: 7.5.x

drupal/templates/varnish-configmap-vcl.yaml

@@ -323,10 +323,9 @@ data:
       # Use first ip from X-Real-IP as parsed ip
       set req.http.X-Parsed-IP = regsub(req.http.X-Real-IP, "[, ].*$", "");
 
-      # Only allow BAN requests from IP addressees in the 'internal' ACL.
+      # Allow BAN requests only from IP addressees in the 'purge' ACL.
       if (req.method == "BAN") {
-        # Admin port is only exposed to internal network
-        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
+        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge) {
           return (synth(403, "Not allowed."));
         }
 
@@ -347,10 +346,9 @@ data:
         return (synth(200, "Ban added."));
       }
 
-      # Only allow URIBAN requests from IP addressees in the 'internal' ACL.
+      # Allow URIBAN requests only from IP addressees in the 'purge' ACL.
       if (req.method == "URIBAN") {
-        # Admin port is only exposed to internal network
-        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
+        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge) {
           return (synth(403, "Not allowed."));
         }
 
@@ -435,8 +433,13 @@ data:
         return (synth( 403, "Forbidden"));
       }
 
-      if (req.http.Authorization || ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal && std.ip(req.http.X-Parsed-IP, "0.0.0.0") !~ upstream_proxy )) {
-        # Not cacheable by default
+      # Do not cache requests with Authorization header
+      if (req.http.Authorization) {
+        return (pass);
+      }
+
+      # Do not cache requests from internal network and upstream proxy ip (passthrough traffic is still cached)
+      if ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
         return (pass);
       }
 
@@ -461,8 +464,7 @@ data:
       }
 
       # Do not allow public access to cron.php , update.php or install.php.
-      if (req.url ~ "^(?:/core)?/(?:cron|install|update)\.php$" && (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy)) {
-        # Have Varnish throw the error directly.
+      if (req.url ~ "^(?:/core)?/(?:cron|install|update)\.php$") {
         return (synth( 404, "Page not found."));
       }
 

drupal/values.yaml

@@ -824,6 +824,8 @@ redis:
 # see: https://github.com/jouve/charts/blob/main/charts/mailpit/values.yaml
 mailpit:
   enabled: false
+  image:
+    tag: v1.28.2
   extraEnvVars:
     - name: MP_SMTP_AUTH_ACCEPT_ANY
       value: "true"

frontend/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: frontend
-version: 1.25.1
+version: 1.25.2
 dependencies:
 - name: mariadb
   version: 7.10.x

frontend/templates/varnish-configmap-vcl.yaml

@@ -87,7 +87,7 @@ data:
       # Only allow BAN requests from IP addressees in the 'internal' ACL.
       if (req.method == "BAN") {
         # Admin port is only exposed to internal network
-        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
+        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge) {
           return (synth(403, "Not allowed."));
         }
 
@@ -107,7 +107,7 @@ data:
       # Only allow URIBAN requests from IP addressees in the 'internal' ACL.
       if (req.method == "URIBAN") {
         # Admin port is only exposed to internal network
-        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
+        if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge) {
           return (synth(403, "Not allowed."));
         }
 
@@ -145,7 +145,12 @@ data:
       }
 
       # Do not cache requests with Authorization header
-      if (req.http.Authorization || ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal && std.ip(req.http.X-Parsed-IP, "0.0.0.0") !~ upstream_proxy )) {
+      if (req.http.Authorization) {
+        return (pass);
+      }
+
+      # Do not cache requests from internal network and upstream proxy ip (passthrough traffic is still cached)
+      if ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal) {
         return (pass);
       }
 

frontend/values.yaml

@@ -662,6 +662,8 @@ signalsciences:
 # Mailpit service overrides
 # see: https://github.com/jouve/charts/blob/main/charts/mailpit/values.yaml
 mailpit:
+  image:
+    tag: v1.28.2
   enabled: false
   extraEnvVars:
     - name: MP_SMTP_AUTH_ACCEPT_ANY