recipe-maintainers/immich
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade immich-server + immich-machine-learning to v3.4.1 #7

Open
autonomic-bot wants to merge 1 commits from upgrade-539fae9 into main
pull from: upgrade-539fae9
merge into: :main
Conversation 6 Commits 1 Files Changed 1
+3 -3
autonomic-bot commented 2026-10-30 03:20:26 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade: immich app + ML v3.3.5 → v3.4.1 (extends this PR with the app/ML bump on top of the pgvectors 0.2.0 → 0.3.0 Postgres bump already here).

Image tag table

service image current (upstream main) new
app ghcr.io/immich-app/immich-server v3.3.5 v3.4.1
immich-machine-learning ghcr.io/immich-app/immich-machine-learning v3.3.5 v3.4.1
database ghcr.io/immich-app/postgres 14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357… 14-vectorchord0.4.3-pgvectors0.3.0@sha256:87c050465… (already in this PR; OCI-index digest re-verified)
redis docker.io/valkey/valkey 9@sha256:418652cf… unchanged (matches v3.4.1's official pin)

v3.4.1 is the newest stable upstream release (2026-11-11); v3.4.0-rc.* are pre-releases and are not taken. The Postgres sidecar stays on the same PG14 + VectorChord 0.4.3 scheme — its pgvectors 0.2.0 → 0.3.0 bump is already in this PR, is backward-compatible, and immich only uses vchord/vector now. Do not take pg15/16/17/18.

What's in the window (v3.3.5 → v3.4.1)

  • v3.3.6 (2026-11-04): privacy/bug-fix patch — disables onnxruntime telemetry in the ML container (immich-app/immich#32956).
  • v3.4.0 (2026-11-10): feature release — workflow improvements (EXIF missing/present match, OCR extraction trigger/filter), JPEG XL support, mobile tags, backups improvements, camera make/model display fixes, and a batch of security fixes (shared-link visibility, plugin allowedHosts anchoring, upload-access checksum check, email-template escaping, CSP inline hashes). No server-side breaking change, no new/renamed config, no manual DB step — new TypeORM migrations auto-run. docker/example.env is byte-identical to v3.3.6.
  • v3.4.1 (2026-11-11): patch — shared-link cover-query performance, queue job-status query, HEIF mime mapping, workflow defaults, prometheus exporter bind, futo backups 1.16.0.

Verification

  • Direct --chaos dev deploy on cc-ci of this branch (bb25663) against upstream main ac03d237: all 4 services converged 1/1.
    • app + ML v3.4.1 running; /api/server/version = {"major":3,"minor":4,"patch":1,...}; /api/server/ping = {"res":"pong"}; ML server healthy.
    • Postgres 14.19 on the pgvectors0.3.0 image; extensions vchord 0.4.3 + vector 0.8.1 present. 104 Kysely migrations applied, including the v3.4.0 AddUpdateIdIndexes, AddAssetOwnerIdUpdateIdIndex, AddPasskeyTable, AddAssetFaceAssetState; new futo_backups_* tables present.
    • Dev deploy torn down completely (0 stacks, 0 volumes, 0 networks, 0 abra apps).
  • abra recipe lint immich -C -n: only pre-existing warnings (R002 healthchecks, R005 semver-like tags); no errors.
  • Advisory scan for 3.3.5 → 3.4.1: 0 CVEs determined fixed, plus 17 security advisories without CVE ids. The 8 unjudged adjudicated as outside this window: six legacy nvd:postgres entries name unrelated packages not present in the image (postgresql-ocaml, PL/php, pgbouncer, Quassel, gin-vue-admin, aiven-extras); CVE-2026-104867 has range >= 3.0.0, <= 3.0.3 and GHSA-h5w4-vjv4-9r5q <= v3.1.0, both already behind 3.3.5 before this window.

Operator Action Required

None. After merge, publish with:

abra recipe release immich -y

(minor bump; no --dry-run). The PR deliberately does not bump the coop-cloud.${STACK_NAME}.version label.

Upstream release notes

NOT merged — for operator review.

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

Recipe upgrade: immich app + ML **v3.3.5 → v3.4.1** (extends this PR with the app/ML bump on top of the pgvectors `0.2.0 → 0.3.0` Postgres bump already here). ## Image tag table | service | image | current (upstream main) | new | |---|---|---|---| | app | ghcr.io/immich-app/immich-server | v3.3.5 | **v3.4.1** | | immich-machine-learning | ghcr.io/immich-app/immich-machine-learning | v3.3.5 | **v3.4.1** | | database | ghcr.io/immich-app/postgres | `14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` | **`14-vectorchord0.4.3-pgvectors0.3.0@sha256:87c050465…`** (already in this PR; OCI-index digest re-verified) | | redis | docker.io/valkey/valkey | `9@sha256:418652cf…` | unchanged (matches v3.4.1's official pin) | v3.4.1 is the newest **stable** upstream release (2026-11-11); `v3.4.0-rc.*` are pre-releases and are not taken. The Postgres sidecar stays on the same PG14 + VectorChord 0.4.3 scheme — its `pgvectors 0.2.0 → 0.3.0` bump is already in this PR, is backward-compatible, and immich only uses `vchord`/`vector` now. Do **not** take pg15/16/17/18. ## What's in the window (v3.3.5 → v3.4.1) - **v3.3.6** (2026-11-04): privacy/bug-fix patch — disables onnxruntime telemetry in the ML container (immich-app/immich#32956). - **v3.4.0** (2026-11-10): feature release — workflow improvements (EXIF missing/present match, OCR extraction trigger/filter), JPEG XL support, mobile tags, backups improvements, camera make/model display fixes, and a batch of security fixes (shared-link visibility, plugin `allowedHosts` anchoring, upload-access checksum check, email-template escaping, CSP inline hashes). No server-side breaking change, no new/renamed config, no manual DB step — new TypeORM migrations auto-run. `docker/example.env` is byte-identical to v3.3.6. - **v3.4.1** (2026-11-11): patch — shared-link cover-query performance, queue job-status query, HEIF mime mapping, workflow defaults, prometheus exporter bind, futo backups 1.16.0. ## Verification - Direct `--chaos` dev deploy on cc-ci of this branch (`bb25663`) against upstream main `ac03d237`: all 4 services converged 1/1. - app + ML **v3.4.1** running; `/api/server/version` = `{"major":3,"minor":4,"patch":1,...}`; `/api/server/ping` = `{"res":"pong"}`; ML server healthy. - Postgres **14.19** on the `pgvectors0.3.0` image; extensions `vchord 0.4.3` + `vector 0.8.1` present. 104 Kysely migrations applied, including the v3.4.0 `AddUpdateIdIndexes`, `AddAssetOwnerIdUpdateIdIndex`, `AddPasskeyTable`, `AddAssetFaceAssetState`; new `futo_backups_*` tables present. - Dev deploy torn down completely (0 stacks, 0 volumes, 0 networks, 0 abra apps). - `abra recipe lint immich -C -n`: only pre-existing warnings (R002 healthchecks, R005 semver-like tags); no errors. - Advisory scan for 3.3.5 → 3.4.1: **0 CVEs** determined fixed, plus 17 security advisories without CVE ids. The 8 unjudged adjudicated as outside this window: six legacy `nvd:postgres` entries name unrelated packages not present in the image (postgresql-ocaml, PL/php, pgbouncer, Quassel, gin-vue-admin, aiven-extras); CVE-2026-104867 has range `>= 3.0.0, <= 3.0.3` and GHSA-h5w4-vjv4-9r5q `<= v3.1.0`, both already behind 3.3.5 before this window. ## Operator Action Required **None.** After merge, publish with: ``` abra recipe release immich -y ``` (minor bump; no `--dry-run`). The PR deliberately does not bump the `coop-cloud.${STACK_NAME}.version` label. ## Upstream release notes - **Upstream release notes:** immich-server v3.3.5→v3.4.1: https://github.com/immich-app/immich/releases/tag/v3.4.0 and https://github.com/immich-app/immich/releases/tag/v3.4.1 (plus https://github.com/immich-app/immich/releases/tag/v3.3.6 for the intermediate patch) - **Upstream release notes:** immich-machine-learning v3.3.5→v3.4.1: same monorepo releases (ML-specific change is immich-app/immich#32956) - **Upstream release notes:** postgres pgvectors 0.2.0→0.3.0 (already in this PR): https://github.com/immich-app/base-images and https://github.com/immich-app/immich/blob/v3.4.1/docker/docker-compose.yml NOT merged — for operator review. CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants
autonomic-bot requested review from trav 2026-10-30 03:20:26 +00:00
autonomic-bot requested review from notplants 2026-10-30 03:20:26 +00:00
autonomic-bot commented 2026-10-30 03:21:03 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-30 03:21:27 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — immich @ 539fae96 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `immich` @ `539fae96` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/105/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/105) [![level](https://ci.autonomic.zone/runs/105/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/105) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/105) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: bump postgres database to pgvectors 0.3.0 to chore: upgrade immich-server + immich-machine-learning to v3.3.6 2026-11-06 04:05:43 +00:00
autonomic-bot commented 2026-11-06 04:06:12 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-06 04:06:38 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — immich @ e455d422 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `immich` @ `e455d422` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/134/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/134) [![level](https://ci.autonomic.zone/runs/134/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/134) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/134) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade immich-server + immich-machine-learning to v3.3.6 to chore: upgrade immich-server + immich-machine-learning to v3.4.1 2026-11-13 04:42:57 +00:00
autonomic-bot added 1 commit 2026-11-13 04:42:57 +00:00
chore: upgrade immich-server + immich-machine-learning to v3.4.1
cc-ci/testme cc-ci: success
Details
926ee88176
autonomic-bot force-pushed upgrade-539fae9 from e455d422a8 to 926ee88176 2026-11-13 04:42:57 +00:00 Compare
autonomic-bot commented 2026-11-13 04:43:15 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-13 04:43:50 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — immich @ 926ee881 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `immich` @ `926ee881` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/149/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/149) [![level](https://ci.autonomic.zone/runs/149/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/149) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/149) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-539fae9:upgrade-539fae9
git checkout upgrade-539fae9
Sign in to join this conversation.
Reviewers
No Reviewers
notplants
trav
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/immich#7