fix: bump executor to 1.3.4 and geo to 0.3.8

CHANGELOG.md

@@ -10,6 +10,7 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ### Security
 
+- `openruntimes/executor` 1.3.4 and `appwrite/geo` 0.3.8, rebuilt on base images with patched git, which clear both images' high findings.
 - Console 1.2.176-self-hosted, `appwrite/embedding` 0.3.3, `appwrite/exiftool` 0.1.2 and `appwrite/autogravity` 0.0.12, rebuilt with patched Debian packages (and, for Autogravity, a patched Go), which clear the open critical and high findings in all four images.
 - ClickHouse 26.8.36, the newest patch of the 26.8 LTS line, which updates musl, zlib and OpenSSL and clears the image's high findings.
 - `appwrite/geo` 0.3.7, which updates `symfony/http-client` to 7.4.23 and clears the image's last high finding.

charts/appwrite/Chart.yaml

@@ -93,11 +93,11 @@ annotations:
     - name: embedding
       image: docker.io/appwrite/embedding:0.3.3
     - name: executor
-      image: docker.io/openruntimes/executor:1.3.3
+      image: docker.io/openruntimes/executor:1.3.4
     - name: exiftool
       image: ghcr.io/appwrite/exiftool:0.1.2
     - name: geo
-      image: docker.io/appwrite/geo:0.3.7
+      image: docker.io/appwrite/geo:0.3.8
     - name: orchestrator
       image: ghcr.io/open-runtimes/orchestrator/jobs-service:5.1.0
     - name: redis

charts/appwrite/README.md

@@ -638,7 +638,7 @@ The SMTP server Appwrite sends mail through.
 | geo.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | geo.image.registry | string | `"docker.io"` | Image registry. |
 | geo.image.repository | string | `"appwrite/geo"` | Image repository. |
-| geo.image.tag | string | `"0.3.7"` | Image tag. |
+| geo.image.tag | string | `"0.3.8"` | Image tag. |
 | geo.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | geo.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
 | geo.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |
@@ -903,7 +903,7 @@ The build orchestrator and the executor.
 | compute.executor.image.digest | string | `""` | Image digest. |
 | compute.executor.image.registry | string | `"docker.io"` | Image registry. The executor image is pulled by the Docker daemon in the pod, not by the kubelet, so image pull secrets don't apply to it. |
 | compute.executor.image.repository | string | `"openruntimes/executor"` | Image repository. |
-| compute.executor.image.tag | string | `"1.3.3"` | Image tag. |
+| compute.executor.image.tag | string | `"1.3.4"` | Image tag. |
 | compute.executor.images | list | `[]` | Runtime images to pull when the executor starts (`OPR_EXECUTOR_IMAGES`). Empty derives them from `functionsRuntimes` and `sitesRuntimes`, e.g. `node-22` becomes `openruntimes/node:v5-22`; with both of those empty too, nothing is pulled ahead of the first executions. |
 | compute.executor.inactiveThreshold | int | `60` | Seconds a runtime may stay idle before it's removed (`OPR_EXECUTOR_INACTIVE_THRESHOLD`). The executor removes idle runtimes in its maintenance pass, which the chart runs hourly (`OPR_EXECUTOR_MAINTENANCE_INTERVAL`), so a runtime can stay up to an hour longer. |
 | compute.executor.namespace | string | `""` | Namespace of the executor. Defaults to `<release namespace>-executor`. Use a different one per release when several releases share a namespace. |

charts/appwrite/tests/executor_test.yaml

@@ -213,7 +213,7 @@ tests:
     asserts:
       - contains:
           path: spec.template.spec.containers[0].env
-          content: {name: EXECUTOR_IMAGE, value: docker.io/openruntimes/executor:1.3.3}
+          content: {name: EXECUTOR_IMAGE, value: docker.io/openruntimes/executor:1.3.4}
       - contains:
           path: spec.template.spec.containers[0].env
           content: {name: OPR_EXECUTOR_IMAGES, value: "openruntimes/node:v5-22,openruntimes/python-ml:v5-3.11,openruntimes/static:v5-1"}

charts/appwrite/values.yaml

@@ -858,7 +858,7 @@ compute:
       # -- Image repository.
       repository: openruntimes/executor
       # -- Image tag.
-      tag: 1.3.3
+      tag: 1.3.4
       # -- Image digest.
       digest: ""
     dind:
@@ -1849,7 +1849,7 @@ geo:
     # -- Image repository.
     repository: appwrite/geo
     # -- Image tag.
-    tag: 0.3.7
+    tag: 0.3.8
     # -- Image digest.
     digest: ""
     # -- Image pull policy.

docs/optional-components.md

@@ -170,7 +170,7 @@ with `mqtt.replicaCount`. `_APP_MQTT_REPLAY_DEPTH` (5) and
 
 | Component | Image | Requests | Memory limit | Replicas |
 | --- | --- | --- | --- | --- |
-| Geo | `docker.io/appwrite/geo:0.3.7` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) |
+| Geo | `docker.io/appwrite/geo:0.3.8` | 20m CPU, 128Mi | 512Mi | `geo.replicaCount` (1) |
 | Browser | `docker.io/appwrite/browser:0.3.13` | 100m CPU, 512Mi | 2Gi | `browser.replicaCount` (1) |
 | ExifTool | `ghcr.io/appwrite/exiftool:0.1.2` | 20m CPU, 128Mi | 512Mi | `exiftool.replicaCount` (1) |
 | Autogravity | `ghcr.io/appwrite/autogravity:0.0.12` | 100m CPU, 512Mi | 2Gi | 1 |