[ChiragAgg5k]

Clears the 18 high findings from CVE-2026-105437, CVE-2026-111760 and CVE-2026-114466 (git) in the executor and geo images.

Image	From	To	Trivy high/critical
openruntimes/executor	1.3.3	1.3.4	0
appwrite/geo	0.3.7	0.3.8	0

[appwrite]

🟢 Tier S · Ready to merge

Bumps the default executor image to 1.3.4 and the geo image to 0.3.8. The chart image inventory, generated README, executor render assertion, and changelog are updated to match.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 6

File	Change
CHANGELOG.md	Records the executor and geo security image updates.
charts/appwrite/Chart.yaml	Updates the executor and geo image inventory tags.
charts/appwrite/README.md	Refreshes the documented default geo and executor tags.
charts/appwrite/tests/executor_test.yaml	Updates the expected executor image tag.
charts/appwrite/values.yaml	Bumps the default executor and geo image tags.
docs/optional-components.md	Updates the documented geo image version.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding	Why
Add coverage for the geo image tag	Verifier: The repo has no default-tag assertions for comparable components. The geo tests never check an image, and the only pinned tags in tests are an incidental executor env check and test overrides. A test pinning geo's default tag would need editing on every bump (Renovate bumps these), so it adds little coverage. This is a nitpick.

---

_{Reviewed 700fde7 · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.}

[appwrite]

🟢 Tier S · Looks good to merge. Summary