From 700fde73ee11f552cb678d1bd3f514dfadabcaea Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Thu, 12 Nov 2026 11:11:13 +0000 Subject: [PATCH] fix: bump executor to 1.3.4 and geo to 0.3.8 Both images are rebuilt on base images with patched git (CVE-2026-105437, CVE-2026-111760, CVE-2026-114466). --- CHANGELOG.md | 1 + charts/appwrite/Chart.yaml | 4 ++-- charts/appwrite/README.md | 4 ++-- charts/appwrite/tests/executor_test.yaml | 2 +- charts/appwrite/values.yaml | 4 ++-- docs/optional-components.md | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1fff3ed..688d297 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ annotation in `charts/appwrite/Chart.yaml`. ### Security +- `openruntimes/executor` 1.3.4 and `appwrite/geo` 0.3.8, rebuilt on base images with patched git, which clear both images' high findings. - Console 1.2.176-self-hosted, `appwrite/embedding` 0.3.3, `appwrite/exiftool` 0.1.2 and `appwrite/autogravity` 0.0.12, rebuilt with patched Debian packages (and, for Autogravity, a patched Go), which clear the open critical and high findings in all four images. - ClickHouse 26.8.36, the newest patch of the 26.8 LTS line, which updates musl, zlib and OpenSSL and clears the image's high findings. - `appwrite/geo` 0.3.7, which updates `symfony/http-client` to 7.4.23 and clears the image's last high finding. diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml index 1ebac37..de61902 100644 --- a/charts/appwrite/Chart.yaml +++ b/charts/appwrite/Chart.yaml @@ -93,11 +93,11 @@ annotations: - name: embedding image: docker.io/appwrite/embedding:0.3.3 - name: executor - image: docker.io/openruntimes/executor:1.3.3 + image: docker.io/openruntimes/executor:1.3.4 - name: exiftool image: ghcr.io/appwrite/exiftool:0.1.2 - name: geo - image: docker.io/appwrite/geo:0.3.7 + image: docker.io/appwrite/geo:0.3.8 - name: orchestrator image: ghcr.io/open-runtimes/orchestrator/jobs-service:5.1.0 - name: redis diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md index 42de5fe..6adcc78 100644 --- a/charts/appwrite/README.md +++ b/charts/appwrite/README.md @@ -638,7 +638,7 @@ The SMTP server Appwrite sends mail through. | geo.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. | | geo.image.registry | string | `"docker.io"` | Image registry. | | geo.image.repository | string | `"appwrite/geo"` | Image repository. | -| geo.image.tag | string | `"0.3.7"` | Image tag. | +| geo.image.tag | string | `"0.3.8"` | Image tag. | | geo.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. | | geo.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. | | geo.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. | @@ -903,7 +903,7 @@ The build orchestrator and the executor. | compute.executor.image.digest | string | `""` | Image digest. | | compute.executor.image.registry | string | `"docker.io"` | Image registry. The executor image is pulled by the Docker daemon in the pod, not by the kubelet, so image pull secrets don't apply to it. | | compute.executor.image.repository | string | `"openruntimes/executor"` | Image repository. | -| compute.executor.image.tag | string | `"1.3.3"` | Image tag. | +| compute.executor.image.tag | string | `"1.3.4"` | Image tag. | | compute.executor.images | list | `[]` | Runtime images to pull when the executor starts (`OPR_EXECUTOR_IMAGES`). Empty derives them from `functionsRuntimes` and `sitesRuntimes`, e.g. `node-22` becomes `openruntimes/node:v5-22`; with both of those empty too, nothing is pulled ahead of the first executions. | | compute.executor.inactiveThreshold | int | `60` | Seconds a runtime may stay idle before it's removed (`OPR_EXECUTOR_INACTIVE_THRESHOLD`). The executor removes idle runtimes in its maintenance pass, which the chart runs hourly (`OPR_EXECUTOR_MAINTENANCE_INTERVAL`), so a runtime can stay up to an hour longer. | | compute.executor.namespace | string | `""` | Namespace of the executor. Defaults to `-executor`. Use a different one per release when several releases share a namespace. | diff --git a/charts/appwrite/tests/executor_test.yaml b/charts/appwrite/tests/executor_test.yaml index 1df73a3..f0faef7 100644 --- a/charts/appwrite/tests/executor_test.yaml +++ b/charts/appwrite/tests/executor_test.yaml @@ -213,7 +213,7 @@ tests: asserts: - contains: path: spec.template.spec.containers[0].env - content: {name: EXECUTOR_IMAGE, value: docker.io/openruntimes/executor:1.3.3} + content: {name: EXECUTOR_IMAGE, value: docker.io/openruntimes/executor:1.3.4} - contains: path: spec.template.spec.containers[0].env content: {name: OPR_EXECUTOR_IMAGES, value: "openruntimes/node:v5-22,openruntimes/python-ml:v5-3.11,openruntimes/static:v5-1"} diff --git a/charts/appwrite/values.yaml b/charts/appwrite/values.yaml index 03639f5..c5d8152 100644 --- a/charts/appwrite/values.yaml +++ b/charts/appwrite/values.yaml @@ -858,7 +858,7 @@ compute: # -- Image repository. repository: openruntimes/executor # -- Image tag. - tag: 1.3.3 + tag: 1.3.4 # -- Image digest. digest: "" dind: @@ -1849,7 +1849,7 @@ geo: # -- Image repository. repository: appwrite/geo # -- Image tag. - tag: 0.3.7 + tag: 0.3.8 # -- Image digest. digest: "" # -- Image pull policy. diff --git a/docs/optional-components.md b/docs/optional-components.md index 2f88846..843a9ea 100644 --- a/docs/optional-components.md +++ b/docs/optional-components.md @@ -170,7 +170,7 @@ with `mqtt.replicaCount`. `_APP_MQTT_REPLAY_DEPTH` (5) and | Component | Image | Requests | Memory limit | Replicas | | --- | --- | --- | --- | --- | -| Geo | `docker.io/appwrite/geo:0.3.7` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) | +| Geo | `docker.io/appwrite/geo:0.3.8` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) | | Browser | `docker.io/appwrite/browser:0.3.13` | 100m CPU, 512Mi | 2Gi | `browser.replicaCount` (1) | | ExifTool | `ghcr.io/appwrite/exiftool:0.1.2` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) | | Autogravity | `ghcr.io/appwrite/autogravity:0.0.12` | 100m CPU, 512Mi | 2Gi | 1 |