Update: I did the jump today. Two things I got wrong above
PostgreSQL. I said to check you’re on 15+. That isn’t the useful check. The current base image ships PostgreSQL 18, and the rebuild migrates you automatically it dumps, restores into a new cluster, then stops with:
UPGRADE OF POSTGRES COMPLETE
To complete the upgrade, rebuild again using: ./launcher rebuild app
Your site stays down until that second rebuild runs. Nothing went wrong, but I wasn’t expecting a two-stage rebuild. The old cluster is kept at /shared/postgres_data_old, and you want 2x your database size free. More detail in PostgreSQL 18 update.
The rich editor is not unconditional. I said it was. The rich_editor site setting is gone, so admins can’t force a mode site-wide any more, but there’s a per-user toggle in the composer and Markdown is completely intact.
Cloudflare can block theme saves. Needed to adjust CSS afterwards. If a theme component has a <script> in its <head> field, saving returns a bare 403.
Cloudflare’s managed rule XSS, HTML Injection – Script Tag blocks the PUT /admin/themes/<id>, because the 2026.7 editor submits every field on save rather than just the one you edited.
A custom rule fixes it:
starts_with(http.request.uri.path, "/admin/themes") and http.request.method eq "PUT"
Action: Skip → managed rules.