# Upstream sources — lasuite-docs

| service | image | source repo | releases / changelog |
|---------|-------|-------------|----------------------|
| app | lasuite/impress-frontend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
| backend | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
| celery | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
| y-provider | lasuite/impress-y-provider | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
| docspec | ghcr.io/docspec/api | https://github.com/docspec/docspec | https://github.com/docspec/docspec/releases |
| db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
| redis | redis | https://github.com/redis/redis | https://hub.docker.com/_/redis/tags |
| minio | quay.io/minio/minio | https://github.com/minio/minio | https://github.com/minio/minio/releases |
| web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |

## Standing notes
- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all
  share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
- AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
- Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
  check manually on https://github.com/minio/minio/releases.
- **2026-08-14: Minio stopped publishing Docker images after RELEASE.2025-09-07T16-13-09Z.**
  GitHub has a newer release (`RELEASE.2025-10-15T17-29-55Z`, published 2025-10-16, with CVE fix
  GHSA-jjjj-jwhf-8rgr), but the Docker image was never pushed to Docker Hub (returns 404; release
  notes say "clone the source and build the latest container"). quay.io checked — only 2022-era
  tags. As of this date, `RELEASE.2025-09-07T16-13-09Z` IS the newest available Docker image.
- v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT.
  Both are backward-compatible (no action required for existing deployments).
- Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
- **v5.4.0 removed Bearer/JWT auth on the API** (upstream PR suitenumerique/docs#2480 dropped
  `mozilla_django_oidc.contrib.drf.OIDCAuthentication` from DRF DEFAULT_AUTHENTICATION_CLASSES).
  The API now accepts only the app's session cookie from the real OIDC authorization-code flow.
  Any test/assertion that sends `Authorization: Bearer <jwt>` to `/api/v1.0/*` will get 401 — this is
  the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in
  cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies
  and assert Bearer is rejected. Don't revert to Bearer assertions.
- redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a
  feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor
  with many new features.
- **2026-09-18: docspec image switched with impress v5.7.0** (upstream PR suitenumerique/docs#2553):
  `ghcr.io/docspecio/api:3.0.x` (Elixir, repo ARCHIVED) → `ghcr.io/docspec/api:1.21.4` (Rust rewrite,
  github.com/docspec/docspec). New image listens on **3000** (was 4000): recipe sets
  `DOCSPEC_API_URL=http://docspec:3000/conversion` and healthcheck `http://127.0.0.1:3000/health`
  (path `/conversion` and the raw-body request contract unchanged).
- ⚠️ When checking GHCR tags by script: the `/tags/list` endpoint CAPS AT 100 tags — a missing tag
  there means nothing. Verify the **manifest** endpoint instead (e.g. `ghcr.io/docspec/api:1.21.4`
  is absent from tags/list but pulls fine).
- **2026-09-13ish: upstream #25 moved the minio pin to `quay.io/minio/minio`** (same
  RELEASE.2025-09-07T16-13-09Z tag — manifest-verified pullable on quay; quay's own tags/list is
  paginated and misleading, use manifest checks there too).
- **v5.7.0 moved the favorites API endpoint to `/documents/favorites/`** — breaking only for
  external API consumers, not the recipe/cc-ci tests (which use /authenticate/, /users/me/,
  /documents/).