cc-ci-orchestrator/cc-ci-plan/upstream/lasuite-docs.md

Upstream sources — lasuite-docs

service	image	source repo	releases / changelog
app	lasuite/impress-frontend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
backend	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
celery	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
y-provider	lasuite/impress-y-provider	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
docspec	ghcr.io/docspecio/api	https://github.com/docspecIO/api	https://github.com/docspecIO/api/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/pgautoupgrade/releases
redis	redis	https://github.com/redis/redis	https://hub.docker.com/_/redis/tags
minio	minio/minio	https://github.com/minio/minio	https://github.com/minio/minio/releases
web	nginx	https://github.com/nginx/nginx	https://nginx.org/en/CHANGES

Standing notes

• impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
• AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
• Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades; check manually on https://github.com/minio/minio/releases.
• v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT. Both are backward-compatible (no action required for existing deployments).
• Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
• v5.4.0 removed Bearer/JWT auth on the API (upstream PR suitenumerique/docs#2480 dropped mozilla_django_oidc.contrib.drf.OIDCAuthentication from DRF DEFAULT_AUTHENTICATION_CLASSES). The API now accepts only the app's session cookie from the real OIDC authorization-code flow. Any test/assertion that sends Authorization: Bearer <jwt> to /api/v1.0/* will get 401 — this is the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies and assert Bearer is rejected. Don't revert to Bearer assertions.
• redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor with many new features.