feat: Appwrite 2.6.2, and fix the upstream drift check

.github/workflows/test-install.yaml

@@ -57,7 +57,7 @@ jobs:
           # and Appwrite's data migration.
           - scenario: default
             kubernetes: v1.37.0
-            upgrade-from: 2.0.0
+            upgrade-from: 2.1.0
           # PostgreSQL, Redis and ClickHouse outside the release.
           - scenario: external-dbs
             kubernetes: v1.37.0
@@ -108,7 +108,7 @@ jobs:
         # instead of as a 15-minute install timeout.
         run: |
           # shellcheck disable=SC2016 # expanded inside the pod
-          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.6.1 --command -- sh -c '
+          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.6.2 --command -- sh -c '
             cat /etc/resolv.conf
             ok=0
             for host in postgres.external-dbs.svc.cluster.local postgres.external-dbs.svc postgres.external-dbs; do

.github/workflows/upstream-drift.yaml

@@ -23,6 +23,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      # gcrunner images ship without PHP, which `make env-defaults` runs.
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: "8.4"
+          tools: none
+          coverage: none
       - name: Compare with the latest Appwrite release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -10,14 +10,42 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ### Security
 
-- Update the Console image to 1.2.106-self-hosted, which patches DOMPurify
-  to 3.4.17 for GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr.
+- Appwrite 2.6.2, a security release: its base image patches Brotli for
+  CVE-2026-111497, and it tightens API keys, realtime, GraphQL, storage,
+  VCS and outbound requests ([release notes](https://github.com/appwrite/appwrite/releases/tag/2.6.2)).
+  No schema change: the data migration is 2.6.1's.
+- Update the Console image to 1.2.108-self-hosted, the one Appwrite 2.6.2
+  ships, which patches DOMPurify to 3.4.17 for GHSA-cg2g-xh64-v4q7 and
+  GHSA-mrv2-3pqr-j5jr.
 - Update the images whose base layers the nightly Trivy scan flags to their
   newest patch releases: Redis 7.4.12-alpine, redis_exporter v1.96.0-alpine,
   SeaweedFS 4.51 and Docker 29.9.2-dind.
 
+### Changed
+
+- The browser 0.3.8 and ExifTool 0.1.1 images, as in Appwrite 2.6.2's
+  `docker-compose.yml`.
+- `_APP_MEMORY_LIMIT`, new in Appwrite 2.6.2, sets the PHP memory limit of
+  every Appwrite process (512M, as before). Raise it, with realtime's memory
+  limit, for a realtime that holds thousands of connections ([production.md](docs/production.md#capacity)).
+- Project SMTP, messaging SMTP providers and migration sources on a private
+  or reserved address need it in `_APP_ALLOWED_INTERNAL_ADDRESSES` from
+  Appwrite 2.6.2 on ([networking.md](docs/networking.md#requests-to-private-addresses)).
+  The chart's own `smtp` settings aren't affected.
+- The console offers Entire as a Git provider ([integrations.md](docs/integrations.md#entire)).
+- CI upgrades from the published chart 2.1.0 with default values.
+
+### Added
+
+- The render fails when `compute.secrets.orchestratorSecret` is Appwrite's
+  placeholder `your-secret-key`, which Appwrite 2.6.2 refuses for job
+  callbacks, unless `compute.secrets.existingSecret` supplies the secret
+  instead. An empty value, the default, still generates a random secret.
+
 ### Fixed
 
+- The weekly upstream drift check installs PHP, which the gcrunner image
+  lacks: it found Appwrite 2.6.2 but failed before opening an issue.
 - `make update-images` writes quoted tags such as SeaweedFS's `"4.48"`
   (it reported the bump but left the file unchanged) and runs on macOS's
   bash 3.2, where an anonymous registry pull failed on an unbound variable.

README.md

@@ -10,7 +10,7 @@ to production, swap each of those for a managed service, one at a time.
 
 | | |
 | --- | --- |
-| Appwrite | 2.6.1 |
+| Appwrite | 2.6.2 |
 | Kubernetes | 1.29 or later |
 | Helm | 4, or 3.18 or later |
 | Chart | `oci://ghcr.io/appwrite/charts/appwrite` |

charts/appwrite/Chart.yaml

@@ -3,10 +3,10 @@ name: appwrite
 description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 type: application
 version: 2.1.0
-appVersion: "2.6.1"
+appVersion: "2.6.2"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/appwrite/helm-chart
-icon: https://raw.githubusercontent.com/appwrite/appwrite/2.6.1/public/images/logos/appwrite-icon.svg
+icon: https://raw.githubusercontent.com/appwrite/appwrite/2.6.2/public/images/logos/appwrite-icon.svg
 sources:
   - https://github.com/appwrite/helm-chart
   - https://github.com/appwrite/appwrite
@@ -73,11 +73,11 @@ annotations:
       description: Troubleshooting for site deployments whose screenshot fails.
   artifacthub.io/images: |
     - name: appwrite
-      image: docker.io/appwrite/appwrite:2.6.1
+      image: docker.io/appwrite/appwrite:2.6.2
     - name: autogravity
       image: ghcr.io/appwrite/autogravity:0.0.11
     - name: browser
-      image: docker.io/appwrite/browser:0.3.6
+      image: docker.io/appwrite/browser:0.3.8
     - name: builds
       image: ghcr.io/open-runtimes/orchestrator/job-sidecar:2.2.4
     - name: builtin
@@ -93,15 +93,15 @@ annotations:
     - name: builtin-exporter
       image: docker.io/oliver006/redis_exporter:v1.96.0-alpine
     - name: console
-      image: docker.io/appwrite/new:1.2.106-self-hosted
+      image: docker.io/appwrite/new:1.2.108-self-hosted
     - name: dind
       image: docker.io/library/docker:29.9.2-dind
     - name: embedding
       image: docker.io/appwrite/embedding:0.3.1
     - name: executor
       image: docker.io/openruntimes/executor:1.1.2
     - name: exiftool
-      image: ghcr.io/appwrite/exiftool:0.1.0
+      image: ghcr.io/appwrite/exiftool:0.1.1
     - name: geo
       image: docker.io/appwrite/geo:0.3.2
     - name: orchestrator

charts/appwrite/README.md

@@ -1,6 +1,6 @@
 # Appwrite Helm chart
 
-![Version: 2.1.0](https://img.shields.io/badge/Version-2.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.1](https://img.shields.io/badge/AppVersion-2.6.1-informational?style=flat-square)
+![Version: 2.1.0](https://img.shields.io/badge/Version-2.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.2](https://img.shields.io/badge/AppVersion-2.6.2-informational?style=flat-square)
 
 Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 
@@ -168,7 +168,7 @@ See the [architecture guide](https://github.com/appwrite/helm-chart/blob/main/do
 - **Highly available datastores.** The built-in ones are single replicas. Use
   managed services or operators in production
   ([guide](https://github.com/appwrite/helm-chart/blob/main/docs/external-databases.md)).
-- **Metrics.** Appwrite 2.6.1 exposes no Prometheus metrics.
+- **Metrics.** Appwrite 2.6.2 exposes no Prometheus metrics.
 
 ## Documentation
 
@@ -595,7 +595,7 @@ The SMTP server Appwrite sends mail through.
 | console.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | console.image.registry | string | `"docker.io"` | Image registry. |
 | console.image.repository | string | `"appwrite/new"` | Image repository. |
-| console.image.tag | string | `"1.2.106-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. |
+| console.image.tag | string | `"1.2.108-self-hosted"` | Image tag. Pinned independently from appVersion so Console security updates can ship separately. |
 | console.livenessProbe.enabled | bool | `true` | Enable the liveness probe. |
 | console.livenessProbe.failureThreshold | int | `3` | Consecutive failures before the probe counts as failed. |
 | console.livenessProbe.periodSeconds | int | `20` | Seconds between probes. |
@@ -980,7 +980,7 @@ The build orchestrator and the executor.
 | browser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | browser.image.registry | string | `"docker.io"` | Image registry. |
 | browser.image.repository | string | `"appwrite/browser"` | Image repository. |
-| browser.image.tag | string | `"0.3.6"` | Image tag. |
+| browser.image.tag | string | `"0.3.8"` | Image tag. |
 | browser.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | browser.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
 | browser.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |
@@ -1130,7 +1130,7 @@ Image, security contexts, scheduling defaults, names, labels and extra objects.
 | exiftool.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | exiftool.image.registry | string | `"ghcr.io"` | Image registry. |
 | exiftool.image.repository | string | `"appwrite/exiftool"` | Image repository. |
-| exiftool.image.tag | string | `"0.1.0"` | Image tag. |
+| exiftool.image.tag | string | `"0.1.1"` | Image tag. |
 | exiftool.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | exiftool.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
 | exiftool.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |

charts/appwrite/README.md.gotmpl

@@ -168,7 +168,7 @@ See the [architecture guide](https://github.com/appwrite/helm-chart/blob/main/do
 - **Highly available datastores.** The built-in ones are single replicas. Use
   managed services or operators in production
   ([guide](https://github.com/appwrite/helm-chart/blob/main/docs/external-databases.md)).
-- **Metrics.** Appwrite 2.6.1 exposes no Prometheus metrics.
+- **Metrics.** Appwrite 2.6.2 exposes no Prometheus metrics.
 
 ## Documentation
 

charts/appwrite/files/env-defaults.yaml

@@ -1,4 +1,4 @@
-# Generated by hack/gen-env-defaults.php from Appwrite 2.6.1
+# Generated by hack/gen-env-defaults.php from Appwrite 2.6.2
 # app/config/variables.php. Do not edit by hand; run `make env-defaults`.
 #
 # These are the defaults the Appwrite Docker installer writes to .env.
@@ -45,6 +45,7 @@ _APP_EMAIL_SECURITY: ""
 _APP_EMAIL_CERTIFICATES: ""
 _APP_LOGGING_FORMAT: "pretty"
 _APP_WORKER_PER_CORE: "6"
+_APP_MEMORY_LIMIT: "512M"
 _APP_CONSOLE_SESSION_ALERTS: "disabled"
 _APP_COMPRESSION_ENABLED: "enabled"
 _APP_COMPRESSION_MIN_SIZE_BYTES: "1024"

charts/appwrite/templates/_validate.tpl

@@ -121,6 +121,9 @@ configmap-env.yaml so it also runs under `helm template`.
 {{- if and (not $e.existingSecret) (or $v.compute.secrets.existingSecret $storage.s3.accessKeyId.secretName $storage.s3.secretAccessKey.secretName) }}
 {{- $errors = append $errors "compute.executor.existingSecret is required when compute.secrets.existingSecret or an S3 secretName (storage.s3.accessKeyId, storage.s3.secretAccessKey) is set: the executor runs in another namespace and can't read them. Create a Secret there with the keys executor-secret, s3-access-key and s3-secret-key." }}
 {{- end }}
+{{- if and (not $v.compute.secrets.existingSecret) (eq $v.compute.secrets.orchestratorSecret "your-secret-key") }}
+{{- $errors = append $errors "compute.secrets.orchestratorSecret is Appwrite's public placeholder, which Appwrite 2.6.2 refuses for job callbacks, so every build would fail. Leave it empty for the chart to generate one, or set a random value." }}
+{{- end }}
 {{- if ne $storage.device "s3" }}
 {{- $errors = append $errors "compute.enabled needs storage.device=s3: builds and the executor exchange code and build output through object storage. Keep the default (s3, with the built-in object store), or set compute.enabled=false to store files on the local volume without Functions and Sites." }}
 {{- end }}

charts/appwrite/tests/executor_test.yaml

@@ -70,6 +70,23 @@ tests:
       - failedTemplate:
           errorPattern: compute.executor.namespace must differ from compute.builds.namespace
 
+  - it: refuses Appwrite's placeholder orchestrator secret
+    template: templates/configmap-env.yaml
+    set:
+      compute.secrets.orchestratorSecret: your-secret-key
+    asserts:
+      - failedTemplate:
+          errorPattern: compute.secrets.orchestratorSecret is Appwrite's public placeholder
+
+  - it: ignores the placeholder when the secrets come from an existing Secret
+    template: templates/configmap-env.yaml
+    set:
+      compute.secrets.orchestratorSecret: your-secret-key
+      compute.secrets.existingSecret: compute
+      compute.executor.existingSecret: executor
+    asserts:
+      - notFailedTemplate: {}
+
   - it: needs its own Secret when credentials come from existing Secrets
     template: templates/configmap-env.yaml
     set:

charts/appwrite/tests/migrations_test.yaml

@@ -19,7 +19,7 @@ tests:
     asserts:
       - equal:
           path: metadata.annotations["appwrite/version"]
-          value: "2.6.1"
+          value: "2.6.2"
 
   - it: doesn't migrate on install
     templates:
@@ -80,7 +80,7 @@ tests:
             name: aw-appwrite-api
             namespace: appwrite
             annotations:
-              appwrite/version: 2.6.1
+              appwrite/version: 2.6.2
     asserts:
       - hasDocuments:
           count: 0
@@ -102,7 +102,7 @@ tests:
               appwrite/version: 2.7.0
     asserts:
       - failedTemplate:
-          errorPattern: Appwrite 2.7.0 is installed and this would downgrade it to 2.6.1
+          errorPattern: Appwrite 2.7.0 is installed and this would downgrade it to 2.6.2
 
   - it: retries a hook migration that failed
     template: templates/hooks/migrate-hook.yaml
@@ -123,7 +123,7 @@ tests:
             name: aw-appwrite-api
             namespace: appwrite
             annotations:
-              appwrite/version: 2.6.1
+              appwrite/version: 2.6.2
         - kind: Job
           apiVersion: batch/v1
           metadata:
@@ -140,11 +140,11 @@ tests:
     asserts:
       - matchRegex:
           path: metadata.name
-          pattern: ^aw-appwrite-migrate-2-6-1-[0-9a-f]{8}$
+          pattern: ^aw-appwrite-migrate-2-6-2-[0-9a-f]{8}$
       # Pinned so the rename test below compares against this exact render.
       - equal:
           path: metadata.name
-          value: aw-appwrite-migrate-2-6-1-8673ad3d
+          value: aw-appwrite-migrate-2-6-2-8c12e5e9
       - notExists:
           path: metadata.annotations["helm.sh/hook"]
       - notExists:
@@ -158,10 +158,10 @@ tests:
     asserts:
       - notEqual:
           path: metadata.name
-          value: aw-appwrite-migrate-2-6-1-8673ad3d
+          value: aw-appwrite-migrate-2-6-2-8c12e5e9
       - matchRegex:
           path: metadata.name
-          pattern: ^aw-appwrite-migrate-2-6-1-[0-9a-f]{8}$
+          pattern: ^aw-appwrite-migrate-2-6-2-[0-9a-f]{8}$
 
   - it: renders nothing in none mode
     templates:

charts/appwrite/tests/serviceaccount_test.yaml

@@ -28,7 +28,7 @@ tests:
             app.kubernetes.io/instance: my-release
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/part-of: appwrite
-            app.kubernetes.io/version: "2.6.1"
+            app.kubernetes.io/version: "2.6.2"
       - matchRegex:
           path: metadata.labels["helm.sh/chart"]
           pattern: ^appwrite-\d+\.\d+\.\d+

charts/appwrite/values.yaml

@@ -428,7 +428,7 @@ vectorsDb:
 
 # Redis, for queues, cache, pub/sub and locks. `builtin` runs a
 # single-replica StatefulSet; `external` connects to a single endpoint
-# without TLS (Appwrite 2.6.1 has no Redis TLS, Sentinel or Cluster).
+# without TLS (Appwrite 2.6.2 has no Redis TLS, Sentinel or Cluster).
 # See docs/external-databases.md#redis.
 redis:
   # -- `builtin` deploys Redis in the release; `external` uses `redis.external`.
@@ -1188,7 +1188,7 @@ console:
     # -- Image repository.
     repository: appwrite/new
     # -- Image tag. Pinned independently from appVersion so Console security updates can ship separately.
-    tag: 1.2.106-self-hosted
+    tag: 1.2.108-self-hosted
     # -- Image digest.
     digest: ""
     # -- Image pull policy.
@@ -1914,7 +1914,7 @@ browser:
     # -- Image repository.
     repository: appwrite/browser
     # -- Image tag.
-    tag: 0.3.6
+    tag: 0.3.8
     # -- Image digest.
     digest: ""
     # -- Image pull policy.
@@ -2045,7 +2045,7 @@ exiftool:
     # -- Image repository.
     repository: appwrite/exiftool
     # -- Image tag.
-    tag: 0.1.0
+    tag: 0.1.1
     # -- Image digest.
     digest: ""
     # -- Image pull policy.

docs/external-databases.md

@@ -141,7 +141,7 @@ Set any that differ on yours.
   CREATE EXTENSION IF NOT EXISTS pg_trgm;
   ```
 
-- **Extensions.** Appwrite 2.6.1 uses three, which Appwrite's own image
+- **Extensions.** Appwrite 2.6.2 uses three, which Appwrite's own image
   (`appwrite/postgres`, PostgreSQL 18) ships:
 
   | Extension | Used for |
@@ -309,7 +309,7 @@ database:
 
 - **One host, no TLS.** Appwrite connects to a single host with a username
   and password. It doesn't take connection strings, so SRV records
-  (`mongodb+srv://`) and TLS aren't supported in 2.6.1. That rules out
+  (`mongodb+srv://`) and TLS aren't supported in 2.6.2. That rules out
   MongoDB Atlas.
 
 ## Connections
@@ -396,7 +396,7 @@ redis:
 
 ### Requirements
 
-- **One endpoint, no TLS.** Appwrite 2.6.1 connects to a single Redis
+- **One endpoint, no TLS.** Appwrite 2.6.2 connects to a single Redis
   endpoint in plain text. TLS, Sentinel and Redis Cluster aren't supported.
   Valkey works as a drop-in replacement.
 - **Memory that never runs out.** Redis holds the job queues as well as the

docs/integrations.md

@@ -261,8 +261,9 @@ a core other than `https://us.auth.entire.io`, `_APP_VCS_ENTIRE_ENDPOINT` in
 `appwrite.config`, and the plugin's Ed25519 private key (PKCS#8 PEM) as
 `_APP_VCS_ENTIRE_PRIVATE_KEY` in a Secret, as for GitHub. Callbacks go to
 `https://<console domain>/v1/vcs/entire/callback` and events to
-`https://<domain>/v1/vcs/entire/events`. The console that ships with 2.6.1
-keeps Entire behind a feature flag that is off.
+`https://<domain>/v1/vcs/entire/events`. The console offers Entire next to
+the other Git providers from 2.6.2 on; 2.6.1's kept it behind a feature
+flag that is off.
 
 ## Console sign-in with GitHub, GitLab, Bitbucket or Google
 
@@ -321,7 +322,7 @@ appwrite:
     _APP_LOGGING_CONFIG: sentry://<project id>:<key>@<sentry host>/
 ```
 
-Sentry is the only provider Appwrite 2.6.1 supports. When the DSN is
+Sentry is the only provider Appwrite 2.6.2 supports. When the DSN is
 invalid, the pods log `Invalid _APP_LOGGING_CONFIG, error reporting is
 disabled` at start-up. Logs go to stdout regardless, as JSON by default
 (`appwrite.logFormat`), ready for your log pipeline.

docs/migrating-from-docker.md

@@ -5,8 +5,8 @@ keeping all data.
 
 Before you start:
 
-- **Same Appwrite version.** The chart deploys Appwrite 2.6.1. Upgrade the
-  Docker install to 2.6.1 first, including its data migration. A Docker
+- **Same Appwrite version.** The chart deploys Appwrite 2.6.2. Upgrade the
+  Docker install to 2.6.2 first, including its data migration. A Docker
   install on 2.2.0 can also move as it is: install the chart with
   `--set image.tag=2.2.0` in step 3 and drop it in step 5, which then runs
   the migration; give that upgrade a `--timeout` long enough for it