From 36019ed8c8e0a58e3a1739e442e967324504dc2c Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Fri, 2 Oct 2026 03:43:41 +0000
Subject: [PATCH] upstream(immich): v3.2.4 pins + release-window notes

---
 cc-ci-plan/upstream/immich.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/cc-ci-plan/upstream/immich.md b/cc-ci-plan/upstream/immich.md
index 3a35964..3fab11f 100644
--- a/cc-ci-plan/upstream/immich.md
+++ b/cc-ci-plan/upstream/immich.md
@@ -79,6 +79,24 @@
   reassign-faces fix) — no breaking changes, no config additions, no operator action. Done in
   the 2026-09-18 upgrade (v3.2.0→v3.2.2, app+ML only; fresh PR — PR #4 was closed when its
   v3.2.0 content merged upstream as #19 / `1.11.0+v3.2.0`).
+- **immich-server v3.2.4 (2026-09-28, latest stable) pins** (from `docker/docker-compose.yml` @ the
+  v3.2.4 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` and
+  `valkey:9@sha256:70739f85ad…` — **BOTH identical to the recipe's v3.2.2-era pins** (DB + redis stay
+  put; live `valkey:9` tag has now moved to `ac9c858b…` = **9.1.2**, but immich's tested
+  `70739f85…` = 9.1.1 is kept per the 2026-07-17 precedent). `example.env` @ v3.2.4 byte-identical to
+  v3.2.2. Window v3.2.2→v3.2.4 is 4 commits: mobile sync-status fix (#31644), an internal `v3.2.3`
+  version commit (no Release object), a base-image dep bump to `202609281550` (#31854), and `v3.2.4`.
+  The v3.2.4 release body: "small patch that primarily fixes the memory leak people have observed
+  through a dependency update." **No breaking changes, no config additions, no operator action.**
+  The base-image bump (`202608300913`→`202609281550`, immich-app/base-images) adds a hardened
+  ImageMagick security policy (#390), reduces server image size (#388), and restores `curl` in the
+  prod image so `immich-healthcheck` works (#391) — all internal to the server image. `v3.3.0-rc.0/1`
+  are pre-releases (2026-09-29/30) — do NOT bump to rc. Done in the 2026-10-02 upgrade
+  (v3.2.2→v3.2.4, app+ML only, fresh PR). Direct registry check confirmed
+  `immich-server/ml:v3.2.4` exist; `abra recipe upgrade` still FATAs on the tag+digest DB pin.
+  Valkey CVE note: CVE-2026-56684 / CVE-2026-63639 (UAF→RCE) are fixed in 9.1.1 and are therefore
+  **already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag
+  drift. CVE-2026-25243 (valkey RESTORE zipmap) is vendor-page-only and undecided.
 - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
   #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
   'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified