[ChiragAgg5k]

Moves the built-in ClickHouse off the 26.4 line to clear its open Trivy findings (trivy-image-clickhouse). 26.8 is the newest LTS line after 26.4; 26.8.36 is its newest patch. Appwrite's docker-compose.yml (main and 2.7.x) still uses 26.4.3-alpine.

Image	Old	New	High+critical before	After
clickhouse/clickhouse-server	26.4.5-alpine	26.8.36-alpine	5 high (musl, musl-utils, zlib, libssl3, libcrypto3)	0

Scanned with trivy image --severity HIGH,CRITICAL --ignore-unfixed --scanners vuln, linux/amd64.

Chart change needed: since 26.7, ClickHouse marks the system log tables it replaces (backup_log_0, s3queue_log_0) table_readonly, so init.sh's ALTER TABLE ... MODIFY TTL failed with TABLE_IS_PERMANENTLY_READ_ONLY and the upgraded pod exited. init.sh now emits RESET SETTING table_readonly before the TTL alter for those tables. On 26.4 the branch never fires.

Backward-incompatible changes in 26.5–26.8 reviewed

Change	Applies?
26.7 rotated system log tables marked table_readonly	Yes, broke init.sh; fixed here
26.8 X-ClickHouse-Format overrides FORMAT	No, Appwrite doesn't send it
26.8 unquoted JSON numbers for DateTime64 read as Unix timestamps	No, Appwrite's usage, audit and execution inserts send quoted Y-m-d H:i:s.v strings
26.8 max_insert_threads default auto	No functional effect: plain MergeTree/SummingMergeTree/ReplacingMergeTree, no row-order dependence
26.8 asynchronous metrics become Map / labelled Prometheus series	Only renames per-CPU/per-device series on the optional /metrics endpoint; the chart ships no rules or dashboards on those names
26.8 include_from no longer defaults to /etc/metrika.xml	No, chart doesn't use it
26.8 lightweight update patch parts v2	No, Appwrite doesn't use lightweight UPDATE; single replica
26.7 S3 from SQL no longer uses server credentials	No, docs/backup-restore.md passes explicit keys
26.7 AggregatingMergeTree rejects non-key dimensions	No, Appwrite uses MergeTree, SummingMergeTree, ReplacingMergeTree
26.7 insert dedup legacy hashes removed / 26.6 new_unified_hash default	No, never set; non-replicated tables, no dedup window
26.6 x86 build targets x86-64-v3 (AVX2)	Nodes need AVX2 (Haswell+); all current cloud x86 nodes have it
26.5 date_time_input_format → best_effort	No, only accepts more formats
26.5 http_max_fields 1000	No change in practice: 26.4.5 already rejects >1000 multipart fields (tested)
Removed functions (snowflakeToDateTime, kql, KQL array sorts, hasColumnInTable remote), RANK(x), arrayIntersect, toTime, Date32/DateTime64 range, EXPLAIN SYNTAX, library dictionaries, Arrow/Parquet readers, NATS/MySQL TLS paths	No, none used by the chart or Appwrite's ClickHouse code

Upgrade test (image run like the pod: read-only root, UID 101, all caps dropped, the chart's rendered config.d/users.d/init.sh from the hardened scenario mounted):

• 26.4.5 on a fresh volume: created MergeTree, SummingMergeTree + MV, partitioned ReplacingMergeTree and a lightweight-update table as the chart's appwrite user, inserted JSONEachRow rows.
• Same volume on 26.8.36 with the old init.sh: pod exits (backup_log_0 read-only). With this init.sh: starts, all rows read back unchanged, new inserts/MV/update work, rotated tables get their TTL.
• Fresh volume on 26.8.36: starts, SELECT version() = 26.8.36.3, create/insert/select works, clean restart.
• Rolling back to 26.4.5 starts and reads the data, but a lightweight update made on 26.8 is not visible (v2 patch parts); Appwrite doesn't issue those.

The kind install scenarios all run the built-in ClickHouse; external-dbs uses the bumped fixture.

Related: appwrite-labs/cloud#6671

[appwrite]

🟢 Tier S · Ready to merge

This bumps the built-in ClickHouse image from 26.4.5 to 26.8.36 and updates the bundled-image metadata and external-database fixture. It also resets table_readonly on replaced system log tables before applying their retention TTLs and updates the image-update helper's ClickHouse release-line comment.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 7

File	Change
CHANGELOG.md	Records the ClickHouse image update and the system-log TTL initialization change.
charts/appwrite/Chart.yaml	Updates the ClickHouse image in the chart's bundled-image metadata.
charts/appwrite/README.md	Reflects the new default ClickHouse image tag.
charts/appwrite/files/clickhouse/init.sh	Resets table_readonly on affected stale tables before modifying their TTL.
charts/appwrite/values.yaml	Sets the built-in ClickHouse default to 26.8.36-alpine.
hack/fixtures/external-dbs.yaml	Updates the ClickHouse image used by the external-databases fixture.
hack/update-images.sh	Updates the documented ClickHouse year.month release line.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding	Why
The new default requires AVX2 on x86 nodes	Verifier: The claim that the 26.8 amd64 image needs x86-64-v3/AVX2 is an unverified assertion about an upstream image. Nothing in the repository supports it. This is a routine Renovate-style tag bump, and the chart has no CPU-capability handling for any other image. I'm dropping it as speculative.

---

_{Reviewed 3776459 · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.}

[appwrite]

🟢 Tier S · Looks good to merge. Summary