Upgrade path guidance: v2.5.7 → v2.5.41 (Docker/Kubernetes deployment)

[Gmanweb]

Summary

We're running MISP v2.5.7 (Docker deployment via ghcr.io/misp/misp-docker/misp-core:v2.5.7) in a Kubernetes environment and want to
upgrade to v2.5.41. Before we proceed, we'd appreciate guidance from maintainers on the upgrade path and any pitfalls.

Current Environment

Component	Version
MISP core	v2.5.7 (ghcr.io/misp/misp-docker/misp-core:v2.5.7)
MISP modules	v2.4.201
PHP	8.2.26
Python	3.12.9
MySQL	8.0.44 (AWS RDS Aurora)
Redis	7.2.5
Base OS	Debian 12 (Bookworm)
Deployment	Kubernetes (Helm chart)
Database datasource	Database/MysqlObserverExtended

Target

• Target version: v2.5.41 (latest-1 for stability)
• Version gap: 34 releases (v2.5.7 → v2.5.41)

Questions

1. Database Schema Migrations

• Are there DB schema changes between v2.5.7 and v2.5.41?
• Are new tables added that we need to be aware of?
• Does the MISP container handle schema migrations automatically on startup (via cake Admin runUpdates or similar), or do we need to
  run migration steps manually?
• Is it safe to jump directly from v2.5.7 → v2.5.41, or should we do intermediate upgrades (e.g., v2.5.7 → v2.5.20 → v2.5.41)?

2. Breaking Changes

• Are there breaking changes to the REST API between these versions that would affect automation consuming /events, /attributes, or
  /tags endpoints?
• Any changes to the /servers/getVersion.json or authentication endpoints?
• Any changes to the event export formats (STIX, CSV, IOC lists)?

3. Configuration Changes

• Are there new required configuration options or environment variables introduced between v2.5.7 and v2.5.41?
• Any changes to the config.php structure that would need manual intervention?
• Is Database/MysqlObserverExtended still the recommended datasource?

4. Dependencies

• Any PHP version requirements above 8.2? Do we need to move to 8.3+?
• Any Python version requirements above 3.12?
• Is MySQL 8.0 still fully supported, or is there a push toward MariaDB/MySQL 8.4?
• Any Redis version requirements?

5. Docker-Specific Upgrade Process

• Is the upgrade path simply pulling the new image tag (v2.5.41) and letting the container handle migrations on startup?
• Are there any volume/mount changes between these versions?
• Any changes to the entrypoint/startup scripts we should be aware of?

6. MISP Modules Compatibility

• What misp-modules version is recommended for MISP v2.5.41?
• Is v2.4.201 still compatible or does it need upgrading alongside?

Our Upgrade Plan (seeking validation)

1. Back up MySQL database (RDS snapshot)
2. Back up persistent volumes (MISP files/attachments)
3. Upgrade in non-prod first (same MySQL 8.0, same Redis)
4. Change image tag from v2.5.7 → v2.5.41 in Helm values
5. Deploy and let container run any automatic migrations
6. Verify API, UI, and IOC export functionality
7. If stable, repeat in production

Is this approach correct, or are there additional steps we're missing?

Context

We're a security team running MISP for IOC aggregation and automated feeds to downstream security tools (WAF, DNS blocklists). We
prioritise stability, which is why we target latest-1 rather than bleeding edge. We need confidence that the upgrade won't break our
automated IOC export pipelines.

I did open a discussion on here MISP/MISP#10875 but I have yet to receive a reply.

Thank you for any guidance.

[ostefano]

LGTM but can't guarantee outcome. I would check on Gitter and ask other users' opinion.

I will close this.