From ef21548015429b3192089e96c7f005f252d1fa5e Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Wed, 11 Nov 2026 16:54:05 +0000 Subject: [PATCH 1/2] fix(chart): bump clickhouse to 26.8.36 Clears the 26.4 image's high Trivy findings (musl, zlib, OpenSSL). 26.8 is the newest LTS line. ClickHouse 26.7+ marks the system log tables it replaces table_readonly, which made init.sh's MODIFY TTL fail and the upgraded pod exit, so init.sh resets the setting first. --- CHANGELOG.md | 2 ++ charts/appwrite/Chart.yaml | 2 +- charts/appwrite/README.md | 2 +- charts/appwrite/files/clickhouse/init.sh | 5 +++-- charts/appwrite/values.yaml | 2 +- hack/fixtures/external-dbs.yaml | 2 +- hack/update-images.sh | 2 +- 7 files changed, 10 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7659c21..77da042 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ annotation in `charts/appwrite/Chart.yaml`. ### Security +- ClickHouse 26.8.36, the newest patch of the 26.8 LTS line, which updates musl, zlib and OpenSSL and clears the image's high findings. - `appwrite/geo` 0.3.7, which updates `symfony/http-client` to 7.4.23 and clears the image's last high finding. - `appwrite/postgres` 0.2.1, `appwrite/browser` 0.3.13 and `openruntimes/executor` 1.3.3, rebuilt with patched packages, which clear all of the database and executor images' critical and high findings and all but one of the browser's. 0.2.1 adds pg_cron and preloads it with pg_stat_statements on new data directories. - `appwrite/embedding` 0.3.2, which clears the image's critical findings and @@ -44,6 +45,7 @@ annotation in `charts/appwrite/Chart.yaml`. ### Changed +- The built-in ClickHouse's `init.sh` resets `table_readonly`, which ClickHouse 26.7 and later set on the system log tables they replace, before giving those tables a TTL. Without it the pod fails to start after the upgrade to 26.8. - The browser 0.3.8 and ExifTool 0.1.1 images, as in Appwrite 2.6.2's `docker-compose.yml`. - `_APP_MEMORY_LIMIT`, new in Appwrite 2.6.2, sets the PHP memory limit of diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml index eee9428..5c5b979 100644 --- a/charts/appwrite/Chart.yaml +++ b/charts/appwrite/Chart.yaml @@ -81,7 +81,7 @@ annotations: - name: builds image: ghcr.io/open-runtimes/orchestrator/job-sidecar:5.1.0 - name: clickhouse - image: docker.io/clickhouse/clickhouse-server:26.4.5-alpine + image: docker.io/clickhouse/clickhouse-server:26.8.36-alpine - name: console image: docker.io/appwrite/new:1.2.138-self-hosted - name: database diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md index c2cb6a9..9058678 100644 --- a/charts/appwrite/README.md +++ b/charts/appwrite/README.md @@ -432,7 +432,7 @@ Built-in or your own. | clickhouse.builtin.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | clickhouse.builtin.image.registry | string | `"docker.io"` | Image registry. | | clickhouse.builtin.image.repository | string | `"clickhouse/clickhouse-server"` | Image repository. | -| clickhouse.builtin.image.tag | string | `"26.4.5-alpine"` | Image tag. | +| clickhouse.builtin.image.tag | string | `"26.8.36-alpine"` | Image tag. | | clickhouse.builtin.metrics.enabled | bool | `false` | Serve ClickHouse's built-in Prometheus endpoint on port 9363 of the Service (`/metrics`). No sidecar. See docs/production.md#monitoring. | | clickhouse.builtin.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. | | clickhouse.builtin.persistence.accessModes | list | `["ReadWriteOnce"]` | Access modes. | diff --git a/charts/appwrite/files/clickhouse/init.sh b/charts/appwrite/files/clickhouse/init.sh index 705ab59..233cdbd 100644 --- a/charts/appwrite/files/clickhouse/init.sh +++ b/charts/appwrite/files/clickhouse/init.sh @@ -14,10 +14,11 @@ # replaced this one, or a week when the log is no longer written at all. # The named logs must match the ones system-log-ttl.xml removes: a log that # is still written gets replaced on the next restart if its TTL is altered here. + # ClickHouse 26.7+ marks the tables it leaves behind table_readonly, which rejects the ALTER. client --format TSVRaw <<'SQL' | client --multiquery -SELECT concat('ALTER TABLE system.', stale.name, ' MODIFY TTL ', if(active.name = '', 'event_date + INTERVAL 7 DAY DELETE', splitByString(' SETTINGS ', splitByString(' TTL ', active.engine_full)[2])[1]), ';') +SELECT concat(if(stale.readonly, concat('ALTER TABLE system.', stale.name, ' RESET SETTING table_readonly;'), ''), 'ALTER TABLE system.', stale.name, ' MODIFY TTL ', if(active.name = '', 'event_date + INTERVAL 7 DAY DELETE', splitByString(' SETTINGS ', splitByString(' TTL ', active.engine_full)[2])[1]), ';') FROM ( - SELECT name, splitByChar('_', name)[-1] AS suffix, arrayStringConcat(arrayPopBack(splitByChar('_', name)), '_') AS log + SELECT name, match(engine_full, 'table_readonly = (1|true)') AS readonly, splitByChar('_', name)[-1] AS suffix, arrayStringConcat(arrayPopBack(splitByChar('_', name)), '_') AS log FROM system.tables WHERE database = 'system' AND position(engine_full, ' TTL ') = 0 diff --git a/charts/appwrite/values.yaml b/charts/appwrite/values.yaml index 55b703c..d56a310 100644 --- a/charts/appwrite/values.yaml +++ b/charts/appwrite/values.yaml @@ -578,7 +578,7 @@ clickhouse: # -- Image repository. repository: clickhouse/clickhouse-server # -- Image tag. - tag: 26.4.5-alpine + tag: 26.8.36-alpine # -- Image digest. digest: "" # -- Image pull policy. diff --git a/hack/fixtures/external-dbs.yaml b/hack/fixtures/external-dbs.yaml index e58fde9..3522b22 100644 --- a/hack/fixtures/external-dbs.yaml +++ b/hack/fixtures/external-dbs.yaml @@ -97,7 +97,7 @@ spec: spec: containers: - name: clickhouse - image: clickhouse/clickhouse-server:26.4.5-alpine + image: clickhouse/clickhouse-server:26.8.36-alpine env: - {name: CLICKHOUSE_DB, value: usage} - {name: CLICKHOUSE_USER, value: usage} diff --git a/hack/update-images.sh b/hack/update-images.sh index 7d4859c..8b382fc 100755 --- a/hack/update-images.sh +++ b/hack/update-images.sh @@ -7,7 +7,7 @@ # same number of version components, so floating tags (7, 7.4, latest) and # pre-releases (-rc.1) are never picked. The built-in datastores stay on their # current major version, as in renovate.json, and ClickHouse on its current -# year.month release (26.4.x), since each of those is a feature release. +# year.month release (26.8.x), since each of those is a feature release. # # The images Renovate groups with Appwrite in renovate.json (the console, # executor, orchestrator and Appwrite's own services) are pinned to what From 3776459bba9b18d2fedb0660c8793c588edbbfa9 Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Wed, 11 Nov 2026 16:54:53 +0000 Subject: [PATCH 2/2] docs(changelog): note the AVX2 requirement of clickhouse 26.8 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 77da042..1e6f57c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -45,7 +45,7 @@ annotation in `charts/appwrite/Chart.yaml`. ### Changed -- The built-in ClickHouse's `init.sh` resets `table_readonly`, which ClickHouse 26.7 and later set on the system log tables they replace, before giving those tables a TTL. Without it the pod fails to start after the upgrade to 26.8. +- The built-in ClickHouse's `init.sh` resets `table_readonly`, which ClickHouse 26.7 and later set on the system log tables they replace, before giving those tables a TTL. Without it the pod fails to start after the upgrade to 26.8, which also needs AVX2 on x86 nodes. - The browser 0.3.8 and ExifTool 0.1.1 images, as in Appwrite 2.6.2's `docker-compose.yml`. - `_APP_MEMORY_LIMIT`, new in Appwrite 2.6.2, sets the PHP memory limit of