Issue Plesk Updates - Expected in 18.0.65 - Now Overdue

[learning_curve]

Server operating system version

Ubuntu 24.04.1 LTS

Plesk version and microupdate number

18.0.65 #

The upgrade from 18.0.64 to 18.0.65 was another smooth / no issues upgrade. Thank you Plesk.

However... The following two items still remain '...not yet fixed...' i.e. They don't appear in the 18.0.65 change-log and our own server(s) show no change.
Details from other threads:

Issue - Apt update warning weak algorithm (dsa1024)

Hi, when I run apt update on my Ubuntu 24.04 server I get the following warning: W: http://autoinstall.plesk.com/pool/PSA_18.0.61_14662/dists/noble/InRelease: Signature by key 8BADC1A02FC9C07FB8C20EC0BD11A6AA914BDF7E uses weak algorithm (dsa1024) W...

talk.plesk.com

Question - Roundcube 1.6.7 is on PHP 8.2 but, Obsidian 18.0.61 is on PHP 8.3 - Why the delay in moving Roundcube on to PHP 8.3?

As per the thread title. Anybody using Roundcube on Obsidian (like us) are currently unable to remove PHP 8.2, purely because of the Obsidian / Roundcube dependencies. Roundcube 1.67 supports PHP 8.3 and Obsidian is now on PHP 8.3, but currently, the Obsidian default setup, is that Roundcube...

talk.plesk.com

~~~ Unfortunately, I cannot provide any ETA for the weak algorithm warning messages ~~~

Note: There's no 3rd party involved, it's Plesk's OWN data that needs "fixing" This issue has been present for over 5 months now.
It's pretty annoying, having screen clutter full of warnings, generated purely by Plesk's delayed action in fixing their own weak algorithim issues...

~~~ As for updating the PHP version of Roundcube to 8.3, that should be introduced in the following Plesk release (unless something goes unpredictably wrong) ~~~

This one, DOES involve a 3rd Party - Roundcube.
Plesk have in fact upgraded Roundcube from 1.6.7 to the 1.6.8 in the interim, but STILL haven't addressed the PHP 8.3 support issue - yet!

Can Plesk, firmly commit, to resolving both of these issues and including the fixes in 18.0.66? That would be appreciated.

 

[Sebahat.hadzhi]

I will further discuss both cases with our team and we will do our best to provide some finality on them. Thank you in advance for your understanding in the meantime.

 

[Sebahat.hadzhi]

I appreciate your patience thus far. I discussed the cases with our team and both of them are prioritized for 18.0.66. Unfortunately, we still cannot provide any finality and confirm on 100% if the fixes will be delivered with the next release.

 

[f.nori]

Hi, after updating to Plesk Ossidiana 18.0.65 sites are disappearing from Google search. Is there any correlation?

 

[learning_curve]

Hi, after updating to Plesk Ossidiana 18.0.65 sites are disappearing from Google search. Is there any correlation?

Correlation does not imply causation...
It would be pure coincidence - if - anything mentioned in this thread, caused your sites to vanish from Google searches.
Can't comment for others, but nothing in this thread has effected us in the same way that you've posted (nor was it expected to).

 

[learning_curve]

The upgrade from 18.0.64 to 18.0.65 was another smooth / no issues upgrade. Thank you Plesk.

However... The following two items still remain '...not yet fixed...' i.e. They don't appear in the 18.0.65 change-log and our own server(s) show no change.
Details from other threads:

Issue - Apt update warning weak algorithm (dsa1024)

Hi, when I run apt update on my Ubuntu 24.04 server I get the following warning: W: http://autoinstall.plesk.com/pool/PSA_18.0.61_14662/dists/noble/InRelease: Signature by key 8BADC1A02FC9C07FB8C20EC0BD11A6AA914BDF7E uses weak algorithm (dsa1024) W...

talk.plesk.com

Question - Roundcube 1.6.7 is on PHP 8.2 but, Obsidian 18.0.61 is on PHP 8.3 - Why the delay in moving Roundcube on to PHP 8.3?

As per the thread title. Anybody using Roundcube on Obsidian (like us) are currently unable to remove PHP 8.2, purely because of the Obsidian / Roundcube dependencies. Roundcube 1.67 supports PHP 8.3 and Obsidian is now on PHP 8.3, but currently, the Obsidian default setup, is that Roundcube...

talk.plesk.com

Note: There's no 3rd party involved, it's Plesk's OWN data that needs "fixing" This issue has been present for over 5 months now.
It's pretty annoying, having screen clutter full of warnings, generated purely by Plesk's delayed action in fixing their own weak algorithim issues...

This one, DOES involve a 3rd Party - Roundcube.
Plesk have in fact upgraded Roundcube from 1.6.7 to the 1.6.8 in the interim, but STILL haven't addressed the PHP 8.3 support issue - yet!

Can Plesk, firmly commit, to resolving both of these issues and including the fixes in 18.0.66? That would be appreciated.

Hmmmmmmm

Some what predictably... Neither of these were fixed / resolved in 18.0.65 (see above) OR 18.0.66 see below.
These are both, way overdue now and it feels like it's become a ...low PR value... let's put them in the some time in the future pile... solution

In the 18.0.66 change-log, we have gems like this one: " Improved the Plesk pages’ loading speed by up to 70% " (sic)
Maybe, it should say; " Improved the Plesk pages’ loading speed by up to 70% - So you can see all the things we still haven't fixed yet, much quicker! "

Joking aside, can we have a FIRM commitment from Plesk, to now fix / resolve both of these, in 18.0.67 and no more future maybes / we'll try etc etc??
Sample images below

@Sebahat.hadzhi @dash

 

[Sebahat.hadzhi]

Thank you for your update. I have further discussed the case with our team, and the target is to include the fixes in the 18.0.67 release. However, to be upfront - 18.0.68 is a more confident timeline for the delivery.

 

[Sebahat.hadzhi]

@learning_curve, just wanted to let you know that the release of the Roundcube PHP update to 8.3 is planned for tomorrow. Unless something goes unpredictably wrong, it should be delivered with version 18.0.67.

 

[learning_curve]

Our upgrades from 18.0.66 to 18.0.67 was another smooth / no issues upgrade. Thank you Plesk.

Issue - Apt update warning weak algorithm (dsa1024)

Hi, when I run apt update on my Ubuntu 24.04 server I get the following warning: W: http://autoinstall.plesk.com/pool/PSA_18.0.61_14662/dists/noble/InRelease: Signature by key 8BADC1A02FC9C07FB8C20EC0BD11A6AA914BDF7E uses weak algorithm (dsa1024) W...

talk.plesk.com

Will this ^^ be in 18.0.68?
This (theoretically) is an easier fix than the one below, as it's entirely under Plesk's control / no 3rd party interfaces involved etc isn't it?

Question - Roundcube 1.6.7 is on PHP 8.2 but, Obsidian 18.0.61 is on PHP 8.3 - Why the delay in moving Roundcube on to PHP 8.3?

As per the thread title. Anybody using Roundcube on Obsidian (like us) are currently unable to remove PHP 8.2, purely because of the Obsidian / Roundcube dependencies. Roundcube 1.67 supports PHP 8.3 and Obsidian is now on PHP 8.3, but currently, the Obsidian default setup, is that Roundcube...

talk.plesk.com

Done and has been updated as required. Thank you Plesk.

 

[Sebahat.hadzhi]

This (theoretically) is an easier fix than the one below, as it's entirely under Plesk's control / no 3rd party interfaces involved etc isn't it?

There are other RPM elements that depend on the signing key, which have to be addressed first. Essentially, this is causing the delay. I cannot confirm if the fix will be released in 18.0.68, I am afraid. The target is 18.0.69 or later.

 

[learning_curve]

Understood, but this is becoming slightly farcical now... Look again when this was first identified & the fix "delayed". Plesk keep adding "garnish" i.e. new UI features, which is great (for some people yes, but unnecessary & not requested by others) yet basic security fixes and updates always appear to be lagging behind these "new features"... Without wanting to add fuel to the fire, besides the original set of Plesk related, weak algorithms that have already been posted, there's now a new set (thanks to the changes related to the imunify Extension - one sample line extract, below) with the result that a simple apt update command, results in over 14 lines screen real estate , dealing with 'warnings' of Plesk's failures to rectify / fix their own weak algorithm (dsa1024) related issues. Hence "The target is 18.0.69 or later." (sic) is untenable really. This could and should be brought forward to 18.0.68 now, as a matter of escalation & urgency.

 https://download.imunify360.com/ubuntu/24.04/slot-1/dists/noble/InRelease: Signature by key 9EE467641C635726A184D64B8C55A6628608CB71 uses weak algorithm (dsa1024)

 

[learning_curve]

~~~ This could and should be brought forward to 18.0.68 now, as a matter of escalation & urgency.

Just to acknowledge that yes, we can mute those warnings, in fairness and in the interim but...

 

[Sebahat.hadzhi]

Unfortunately, the fix is not as simple as assigning a new key. A through investigation was required and performed to exclude possible incompatibilities with extensions signing during installations/updates, PHP updates, etc.

 

[learning_curve]

Unfortunately, the fix is not as simple as assigning a new key. A through investigation was required and performed to exclude possible incompatibilities with extensions signing during installations/updates, PHP updates, etc.

Fully support the integrity verification / validity process by Plesk, but... this has been an unresolved issue that's directly related to Plesk, for OVER 7 months now. It's a very, very big credibility ask, for everyone to just agree that said additional work, in this specific case, could, should or would take this long.