cc-ci-orchestrator/cc-ci-plan/upstream/lasuite-docs.md

Upstream sources — lasuite-docs

service	image	source repo	releases / changelog
app	lasuite/impress-frontend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
backend	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
celery	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
y-provider	lasuite/impress-y-provider	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
docspec	ghcr.io/docspec/api	https://github.com/docspec/docspec	https://github.com/docspec/docspec/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade/releases
redis	redis	https://github.com/redis/redis	https://hub.docker.com/_/redis/tags
minio	quay.io/minio/minio	https://github.com/minio/minio	https://github.com/minio/minio/releases
web	nginx	https://github.com/nginx/nginx	https://nginx.org/en/CHANGES

Standing notes

• impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
• AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
• Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades; check manually on https://github.com/minio/minio/releases.
• 2026-08-14: Minio stopped publishing Docker images after RELEASE.2025-09-07T16-13-09Z. GitHub has a newer release (RELEASE.2025-10-15T17-29-55Z, published 2025-10-16, with CVE fix GHSA-jjjj-jwhf-8rgr), but the Docker image was never pushed to Docker Hub (returns 404; release notes say "clone the source and build the latest container"). quay.io checked — only 2022-era tags. As of this date, RELEASE.2025-09-07T16-13-09Z IS the newest available Docker image.
• v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT. Both are backward-compatible (no action required for existing deployments).
• Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
• v5.4.0 removed Bearer/JWT auth on the API (upstream PR suitenumerique/docs#2480 dropped mozilla_django_oidc.contrib.drf.OIDCAuthentication from DRF DEFAULT_AUTHENTICATION_CLASSES). The API now accepts only the app's session cookie from the real OIDC authorization-code flow. Any test/assertion that sends Authorization: Bearer <jwt> to /api/v1.0/* will get 401 — this is the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies and assert Bearer is rejected. Don't revert to Bearer assertions.
• redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor with many new features.
• 2026-09-18: docspec image switched with impress v5.7.0 (upstream PR suitenumerique/docs#2553): ghcr.io/docspecio/api:3.0.x (Elixir, repo ARCHIVED) → ghcr.io/docspec/api:1.21.4 (Rust rewrite, github.com/docspec/docspec). New image listens on 3000 (was 4000): recipe sets DOCSPEC_API_URL=http://docspec:3000/conversion and healthcheck http://127.0.0.1:3000/health (path /conversion and the raw-body request contract unchanged).
• ⚠️ When checking GHCR tags by script: the /tags/list endpoint CAPS AT 100 tags — a missing tag there means nothing. Verify the manifest endpoint instead (e.g. ghcr.io/docspec/api:1.21.4 is absent from tags/list but pulls fine).
• 2026-09-13ish: upstream #25 moved the minio pin to quay.io/minio/minio (same RELEASE.2025-09-07T16-13-09Z tag — manifest-verified pullable on quay; quay's own tags/list is paginated and misleading, use manifest checks there too).
• v5.7.0 moved the favorites API endpoint to /documents/favorites/ — breaking only for external API consumers, not the recipe/cc-ci tests (which use /authenticate/, /users/me/, /documents/).