From c97798ff8f6f17d10efe14fffab732f516daaf73 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 9 Oct 2026 02:55:01 +0000 Subject: [PATCH] upstream(immich): v3.3.0/v3.3.1 pins + release-window notes --- cc-ci-plan/upstream/immich.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/cc-ci-plan/upstream/immich.md b/cc-ci-plan/upstream/immich.md index 3fab11f..d8b2ed4 100644 --- a/cc-ci-plan/upstream/immich.md +++ b/cc-ci-plan/upstream/immich.md @@ -95,8 +95,23 @@ (v3.2.2→v3.2.4, app+ML only, fresh PR). Direct registry check confirmed `immich-server/ml:v3.2.4` exist; `abra recipe upgrade` still FATAs on the tag+digest DB pin. Valkey CVE note: CVE-2026-56684 / CVE-2026-63639 (UAF→RCE) are fixed in 9.1.1 and are therefore - **already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag + ** already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag drift. CVE-2026-25243 (valkey RESTORE zipmap) is vendor-page-only and undecided. +- **immich-server v3.3.0 (2026-10-07) + v3.3.1 (2026-10-08, latest stable) pins** (from + `docker/docker-compose.yml` @ the v3.3.1 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` + (UNCHANGED vs v3.2.4) and `valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d` + — the **valkey pin moved** 9.1.1 (`70739f85…`) → **9.1.2 (`c123e371…`)**, which is now immich's own + official tested pin (the live `9` tag has since drifted to `418652cf…`; keep immich's `c123e371…` + per the 2026-07-17 precedent). `example.env` @ v3.3.1 is **byte-identical** to v3.2.4. v3.3.0 is a + feature release (people sharing / cluster groups, birthday memories, auto-stacked mobile edits, + higher-quality thumbnails via linear-light resampling, OAuth claims synced on every login, PP-OCRv6 + OCR models); v3.3.1 is a patch (people-sharing + mobile scroll fixes). **No breaking server-side + changes, no required config, no operator action.** New TypeORM migrations auto-run + (`ConvertUserOAuthIdEmptyStringToNull`, `RenameGeoNamesCountries`, `PersonSharing`, + `AddPersonUserTableSharedBySharedWithConstraint`) — all succeeded in a live v3.2.4→v3.3.1 deploy. + Opt-in only: `MACHINE_LEARNING_MODEL_REVISION=v2` (optimized models, numerically equivalent, no job + re-run) and the people-sharing feature (user-triggered button, not a deploy migration). Done in the + 2026-10-09 upgrade (v3.2.4→v3.3.1, app+ML+valkey, extending PR #6; fresh `!testme` GREEN — build #45). - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for 'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified