feat(baikal): update to Baikal 0.12.1 and track sabre-io releases (#3039)

* feat(baikal): update to Baikal 0.12.1 and track sabre-io releases

ckulka/baikal-docker, and the archived fork the addon was based on, stopped
publishing images at Baikal 0.10.1, so the addon could not follow upstream and
its updater tracked a repository that no longer moves.

The base image is now used for its runtime only (nginx, php-fpm, msmtp) and the
application comes from the release published by sabre-io, which the updater can
follow. The Home Assistant timezone fix the fork carried as a whole patched
Plugin.php is applied as the single hunk it actually is, and the build fails if
sabre/dav ever moves that code.

The addon data folder holds the application as well as the user data, and it was
seeded with no-clobber, so a rebuilt image never replaced the code being served.
Application folders are now refreshed on every start ; Specific and config are
still only seeded when missing.

Closes #3038

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(baikal): satisfy markdownlint on the new changelog and readme lines

Bare URLs (MD034) and a heading with no blank line before its list (MD022 /
MD032). The blank line matches the older hand-written entries in the same file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

baikal/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.12.1 (2026-09-03)
+
+- Update to Baikal 0.12.1 from 0.10.1 (changelog : <https://github.com/sabre-io/Baikal/releases>). This includes the 0.12.1 fix for an XSS vulnerability that let an authenticated user take over the admin interface by renaming a calendar
+- ⚠ After the update, open the Baikal web admin once : Baikal asks to confirm the upgrade before it serves calendars again
+- The application is now taken from the release published by sabre-io instead of from the ckulka/baikal-docker image, which stopped at 0.10.1. The base image still provides nginx, php-fpm and msmtp. Automatic version tracking is enabled again, following sabre-io/Baikal
+- The Baikal application files in the addon data folder are now replaced on every start instead of being kept. Calendars, contacts, users and the Baikal configuration are untouched ; any manual edit made inside the application folders themselves is lost
+
 - The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
 
 ## 0.10.1-hafix4 (2025-11-18)

baikal/Dockerfile

@@ -16,7 +16,19 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="0.10.1+hafix"
+ARG BUILD_UPSTREAM="0.12.1"
+
+# ckulka/baikal-docker, which builds the base image, stopped publishing new
+# Baikal versions at 0.10.1 : the base image is used for its runtime only
+# (nginx, php-fpm, msmtp) and the application comes from the release published
+# by sabre-io itself
+FROM alpine:3.21 AS baikal
+ARG BUILD_UPSTREAM
+RUN apk add --no-cache curl unzip \
+    && curl -f -s -S -L -o /tmp/baikal.zip "https://github.com/sabre-io/Baikal/releases/download/${BUILD_UPSTREAM}/baikal-${BUILD_UPSTREAM}.zip" \
+    && unzip -q /tmp/baikal.zip -d / \
+    && rm /tmp/baikal.zip
+
 FROM ${BUILD_FROM}
 
 ##################
@@ -28,6 +40,24 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
     S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
     S6_SERVICES_GRACETIME=0
 
+# Ship the Baikal release instead of the one bundled in the base image
+RUN rm -rf /var/www/baikal
+COPY --from=baikal --chown=nginx:nginx /baikal /var/www/baikal
+
+# Home Assistant asks for an expanded time range, and Baikal stores
+# cal:calendar-timezone as a bare timezone name rather than as the VTIMEZONE
+# object sabre/dav expects, so sabre/dav raises a ParseException and answers
+# 500 (sabre-io/Baikal#1241 and sabre-io/dav#1318, both still open). Read the
+# value as a timezone name instead. The two checks turn a release that moved
+# this code into a failed build rather than into an addon that Home Assistant
+# cannot read.
+# hadolint ignore=SC2016
+RUN \
+    DAVPLUGIN="/var/www/baikal/vendor/sabre/dav/lib/CalDAV/Plugin.php" \
+    && sed -i '/^                \/\/ This property contains a VCALENDAR with a single$/,/^                \$vtimezoneObj->destroy();$/c\                $calendarTimeZone = new DateTimeZone($tzResult[$tzProp]);' "$DAVPLUGIN" \
+    && grep -qxF '                $calendarTimeZone = new DateTimeZone($tzResult[$tzProp]);' "$DAVPLUGIN" \
+    && ! grep -qxF '                $calendarTimeZone = $vtimezoneObj->VTIMEZONE->getTimeZone();' "$DAVPLUGIN"
+
 # Image specific modifications
 # hadolint ignore=SC2015, SC2013, SC2086
 RUN \

baikal/README.md

@@ -33,7 +33,9 @@ _Thanks to everyone having starred my repo! To star it click on the image below,
 ---
 
 [Baikal](https://sabre.io/baikal/) is a lightweight CalDAV+CardDAV server. It offers an extensive web interface with easy management of users, address books and calendars. It is fast and simple to install and only needs a basic php capable server. The data can be stored in a MySQL or a SQLite database.
-It is based on the docker image : https://github.com/ckulka/baikal-docker
+It ships the release published by [sabre-io](https://github.com/sabre-io/Baikal/releases), running on the nginx and php-fpm image built by <https://github.com/ckulka/baikal-docker>.
+
+After an update of Baikal itself, open the web admin once : Baikal asks to confirm the upgrade before it serves calendars again. Calendars, contacts, users and the Baikal configuration are kept, but a manual edit made inside the application folders themselves is replaced on every start.
 
 ## Configuration
 

baikal/build.json

@@ -1,6 +1,6 @@
 {
     "build_from": {
-        "aarch64": "ghcr.io/mralucarddante/baikal-docker-hass:latest",
-        "amd64": "ghcr.io/mralucarddante/baikal-docker-hass:latest"
+        "aarch64": "ckulka/baikal:nginx-php8.2",
+        "amd64": "ckulka/baikal:nginx-php8.2"
     }
 }

baikal/config.yaml

@@ -84,5 +84,5 @@ schema:
 slug: baikal
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: 0.10.1-hafix4
+version: "0.12.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:80]"

baikal/rootfs/etc/cont-init.d/90-run.sh

@@ -1,7 +1,21 @@
 #!/bin/bash
+set -e
 
-# Copy data
-cp -rnf /var/www/baikal/* /data/
+# Baikal keeps its database in Specific and its configuration in config. The
+# release ships both as empty folders, so they are created here rather than
+# copied, and are then left alone : they hold the user's data
+mkdir -p /data/config /data/Specific/db
+
+# Everything else is application code, and is replaced on every start so that a
+# rebuilt image actually replaces the code that is served
+for item in /var/www/baikal/*; do
+    name="$(basename "$item")"
+    case "$name" in
+        Specific | config) continue ;;
+    esac
+    rm -rf "/data/$name"
+    cp -rf "$item" /data/
+done
 
 # Fix permissions
 chown -R nginx:nginx /data

baikal/updater.json

@@ -1,9 +1,9 @@
 {
-  "github_exclude": "+",
-  "last_update": "26-04-2025",
+  "github_beta": "false",
+  "last_update": "2026-09-03",
   "repository": "alexbelgium/hassio-addons",
   "slug": "baikal",
   "source": "github",
-  "upstream_repo": "ckulka/baikal-docker",
-  "upstream_version": "0.10.1"
+  "upstream_repo": "sabre-io/Baikal",
+  "upstream_version": "0.12.1"
 }