recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(immich): v3.3.0/v3.3.1 pins + release-window notes

Browse Source
This commit is contained in:
autonomic-bot
2026-10-09 02:55:01 +00:00
parent 4a043b12ca
commit c97798ff8f
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/immich.md
+16 -1
View File
@@ -95,8 +95,23 @@
(v3.2.2→v3.2.4, app+ML only, fresh PR). Direct registry check confirmed
`immich-server/ml:v3.2.4` exist; `abra recipe upgrade` still FATAs on the tag+digest DB pin.
Valkey CVE note: CVE-2026-56684 / CVE-2026-63639 (UAF→RCE) are fixed in 9.1.1 and are therefore
**already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag
** already closed** by the recipe's pinned 9.1.1 — not by this app bump; ignore the live-`9`-tag
drift. CVE-2026-25243 (valkey RESTORE zipmap) is vendor-page-only and undecided.
- **immich-server v3.3.0 (2026-10-07) + v3.3.1 (2026-10-08, latest stable) pins** (from
`docker/docker-compose.yml` @ the v3.3.1 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…`
(UNCHANGED vs v3.2.4) and `valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d`
— the **valkey pin moved** 9.1.1 (`70739f85…`) → **9.1.2 (`c123e371…`)**, which is now immich's own
official tested pin (the live `9` tag has since drifted to `418652cf…`; keep immich's `c123e371…`
per the 2026-07-17 precedent). `example.env` @ v3.3.1 is **byte-identical** to v3.2.4. v3.3.0 is a
feature release (people sharing / cluster groups, birthday memories, auto-stacked mobile edits,
higher-quality thumbnails via linear-light resampling, OAuth claims synced on every login, PP-OCRv6
OCR models); v3.3.1 is a patch (people-sharing + mobile scroll fixes). **No breaking server-side
changes, no required config, no operator action.** New TypeORM migrations auto-run
(`ConvertUserOAuthIdEmptyStringToNull`, `RenameGeoNamesCountries`, `PersonSharing`,
`AddPersonUserTableSharedBySharedWithConstraint`) — all succeeded in a live v3.2.4→v3.3.1 deploy.
Opt-in only: `MACHINE_LEARNING_MODEL_REVISION=v2` (optimized models, numerically equivalent, no job
re-run) and the people-sharing feature (user-triggered button, not a deploy migration). Done in the
2026-10-09 upgrade (v3.2.4→v3.3.1, app+ML+valkey, extending PR #6; fresh `!testme` GREEN — build #45).
- **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
#1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified