diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e6f57c..1fff3ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ annotation in `charts/appwrite/Chart.yaml`. ### Security +- Console 1.2.176-self-hosted, `appwrite/embedding` 0.3.3, `appwrite/exiftool` 0.1.2 and `appwrite/autogravity` 0.0.12, rebuilt with patched Debian packages (and, for Autogravity, a patched Go), which clear the open critical and high findings in all four images. - ClickHouse 26.8.36, the newest patch of the 26.8 LTS line, which updates musl, zlib and OpenSSL and clears the image's high findings. - `appwrite/geo` 0.3.7, which updates `symfony/http-client` to 7.4.23 and clears the image's last high finding. - `appwrite/postgres` 0.2.1, `appwrite/browser` 0.3.13 and `openruntimes/executor` 1.3.3, rebuilt with patched packages, which clear all of the database and executor images' critical and high findings and all but one of the browser's. 0.2.1 adds pg_cron and preloads it with pg_stat_statements on new data directories. diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml index 5c5b979..1ebac37 100644 --- a/charts/appwrite/Chart.yaml +++ b/charts/appwrite/Chart.yaml @@ -75,7 +75,7 @@ annotations: - name: appwrite image: docker.io/appwrite/appwrite:2.6.2 - name: autogravity - image: ghcr.io/appwrite/autogravity:0.0.11 + image: ghcr.io/appwrite/autogravity:0.0.12 - name: browser image: docker.io/appwrite/browser:0.3.13 - name: builds @@ -83,7 +83,7 @@ annotations: - name: clickhouse image: docker.io/clickhouse/clickhouse-server:26.8.36-alpine - name: console - image: docker.io/appwrite/new:1.2.138-self-hosted + image: docker.io/appwrite/new:1.2.176-self-hosted - name: database image: docker.io/appwrite/postgres:0.2.1 - name: database-exporter @@ -91,11 +91,11 @@ annotations: - name: dind image: docker.io/library/docker:29.9.3-dind - name: embedding - image: docker.io/appwrite/embedding:0.3.2 + image: docker.io/appwrite/embedding:0.3.3 - name: executor image: docker.io/openruntimes/executor:1.3.3 - name: exiftool - image: ghcr.io/appwrite/exiftool:0.1.1 + image: ghcr.io/appwrite/exiftool:0.1.2 - name: geo image: docker.io/appwrite/geo:0.3.7 - name: orchestrator diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md index 9058678..42de5fe 100644 --- a/charts/appwrite/README.md +++ b/charts/appwrite/README.md @@ -595,7 +595,7 @@ The SMTP server Appwrite sends mail through. | console.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | console.image.registry | string | `"docker.io"` | Image registry. | | console.image.repository | string | `"appwrite/new"` | Image repository. | -| console.image.tag | string | `"1.2.138-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. | +| console.image.tag | string | `"1.2.176-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. | | console.livenessProbe.enabled | bool | `true` | Enable the liveness probe. | | console.livenessProbe.failureThreshold | int | `3` | Consecutive failures before the probe counts as failed. | | console.livenessProbe.periodSeconds | int | `20` | Seconds between probes. | @@ -959,7 +959,7 @@ The build orchestrator and the executor. | autogravity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | autogravity.image.registry | string | `"ghcr.io"` | Image registry. | | autogravity.image.repository | string | `"appwrite/autogravity"` | Image repository. | -| autogravity.image.tag | string | `"0.0.11"` | Image tag. | +| autogravity.image.tag | string | `"0.0.12"` | Image tag. | | autogravity.modelBackend | string | `"focalnet"` | Model backend (`MODEL_BACKEND`). | | autogravity.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. | | autogravity.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. | @@ -1003,7 +1003,7 @@ The build orchestrator and the executor. | embedding.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | embedding.image.registry | string | `"docker.io"` | Image registry. | | embedding.image.repository | string | `"appwrite/embedding"` | Image repository. | -| embedding.image.tag | string | `"0.3.2"` | Image tag. | +| embedding.image.tag | string | `"0.3.3"` | Image tag. | | embedding.models | list | `["nomic-embed-text"]` | Models to load (`EMBEDDING_MODELS`). | | embedding.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. | | embedding.persistence.enabled | bool | `true` | Keep downloaded models in a PersistentVolumeClaim. | @@ -1131,7 +1131,7 @@ Image, security contexts, scheduling defaults, names, labels and extra objects. | exiftool.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | exiftool.image.registry | string | `"ghcr.io"` | Image registry. | | exiftool.image.repository | string | `"appwrite/exiftool"` | Image repository. | -| exiftool.image.tag | string | `"0.1.1"` | Image tag. | +| exiftool.image.tag | string | `"0.1.2"` | Image tag. | | exiftool.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. | | exiftool.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. | | exiftool.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. | diff --git a/charts/appwrite/values.yaml b/charts/appwrite/values.yaml index d56a310..03639f5 100644 --- a/charts/appwrite/values.yaml +++ b/charts/appwrite/values.yaml @@ -1194,7 +1194,7 @@ console: # -- Image repository. repository: appwrite/new # -- Image tag. Pinned independently from appVersion so Console security updates can ship separately. - tag: 1.2.138-self-hosted + tag: 1.2.176-self-hosted # -- Image digest. digest: "" # -- Image pull policy. @@ -1981,7 +1981,7 @@ autogravity: # -- Image repository. repository: appwrite/autogravity # -- Image tag. - tag: 0.0.11 + tag: 0.0.12 # -- Image digest. digest: "" # -- Image pull policy. @@ -2047,7 +2047,7 @@ exiftool: # -- Image repository. repository: appwrite/exiftool # -- Image tag. - tag: 0.1.1 + tag: 0.1.2 # -- Image digest. digest: "" # -- Image pull policy. @@ -2115,7 +2115,7 @@ embedding: # -- Image repository. repository: appwrite/embedding # -- Image tag. - tag: 0.3.2 + tag: 0.3.3 # -- Image digest. digest: "" # -- Image pull policy. diff --git a/docs/optional-components.md b/docs/optional-components.md index 571a7dd..2f88846 100644 --- a/docs/optional-components.md +++ b/docs/optional-components.md @@ -172,9 +172,9 @@ with `mqtt.replicaCount`. `_APP_MQTT_REPLAY_DEPTH` (5) and | --- | --- | --- | --- | --- | | Geo | `docker.io/appwrite/geo:0.3.7` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) | | Browser | `docker.io/appwrite/browser:0.3.13` | 100m CPU, 512Mi | 2Gi | `browser.replicaCount` (1) | -| ExifTool | `ghcr.io/appwrite/exiftool:0.1.1` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) | -| Autogravity | `ghcr.io/appwrite/autogravity:0.0.11` | 100m CPU, 512Mi | 2Gi | 1 | -| Embedding | `docker.io/appwrite/embedding:0.3.2` | 250m CPU, 1Gi | 4Gi | 1 | +| ExifTool | `ghcr.io/appwrite/exiftool:0.1.2` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) | +| Autogravity | `ghcr.io/appwrite/autogravity:0.0.12` | 100m CPU, 512Mi | 2Gi | 1 | +| Embedding | `docker.io/appwrite/embedding:0.3.3` | 250m CPU, 1Gi | 4Gi | 1 | | MQTT | the Appwrite image | 50m CPU, 128Mi | 512Mi | `mqtt.replicaCount` (1) | Change the requests and limits under `.resources`, and the image