recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(immich): v3.2.4 pins + release-window notes

Browse Source
This commit is contained in:
autonomic-bot
2026-10-02 03:43:41 +00:00
parent 004c9bcdd3
commit 36019ed8c8
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/immich.md
+18
View File
@@ -79,6 +79,24 @@
reassign-faces fix) — no breaking changes, no config additions, no operator action. Done in reassign-faces fix) — no breaking changes, no config additions, no operator action. Done in
the 2026-09-18 upgrade (v3.2.0→v3.2.2, app+ML only; fresh PR — PR #4 was closed when its the 2026-09-18 upgrade (v3.2.0→v3.2.2, app+ML only; fresh PR — PR #4 was closed when its
v3.2.0 content merged upstream as #19 / `1.11.0+v3.2.0`). v3.2.0 content merged upstream as #19 / `1.11.0+v3.2.0`).
- **immich-server v3.2.4 (2026-09-28, latest stable) pins** (from `docker/docker-compose.yml` @ the
v3.2.4 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` and
`valkey:9@sha256:70739f85ad…` — **BOTH identical to the recipe's v3.2.2-era pins** (DB + redis stay
put; live `valkey:9` tag has now moved to `ac9c858b…` = **9.1.2**, but immich's tested
`70739f85…` = 9.1.1 is kept per the 2026-07-17 precedent). `example.env` @ v3.2.4 byte-identical to
v3.2.2. Window v3.2.2→v3.2.4 is 4 commits: mobile sync-status fix (#31644), an internal `v3.2.3`
version commit (no Release object), a base-image dep bump to `202609281550` (#31854), and `v3.2.4`.
The v3.2.4 release body: "small patch that primarily fixes the memory leak people have observed
through a dependency update." **No breaking changes, no config additions, no operator action.**
The base-image bump (`202608300913`→`202609281550`, immich-app/base-images) adds a hardened
ImageMagick security policy (#390), reduces server image size (#388), and restores `curl` in the
prod image so `immich-healthcheck` works (#391) — all internal to the server image. `v3.3.0-rc.0/1`
are pre-releases (2026-09-29/30) — do NOT bump to rc. Done in the 2026-10-02 upgrade
(v3.2.2→v3.2.4, app+ML only, fresh PR). Direct registry check confirmed
`immich-server/ml:v3.2.4` exist; `abra recipe upgrade` still FATAs on the tag+digest DB pin.
Valkey CVE note: CVE-2026-56684 / CVE-2026-63639 (UAF→RCE) are fixed in 9.1.1 and are therefore
**already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag
drift. CVE-2026-25243 (valkey RESTORE zipmap) is vendor-page-only and undecided.
- **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
#1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified 'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified