Repository navigation
app: follow upstream Supabase 0.8.4, Dify 1.19.0, JumpServer 5.1.1 and channel fixes - #797
Merged
Merged
Conversation
Security update: bump Storage, Realtime, Envoy, imgproxy, Edge Runtime and the coordinated images. Port the gateway changes (function-owned CORS, sb_ key translation and timeouts on /functions/v1/, OAuth/OIDC discovery routes, Envoy DNS refresh) to Envoy and Kong with typed template rendering, sync the Edge worker and memory-pressure monitor, and add FUNCTIONS_MEMORY_LIMIT (2g). No SQL is needed: upstream volumes/db is unchanged; back up before upgrading because Storage migrations are one-way. Logflare stays on 1.50.15. Statically validated (compose config for all override combinations, image manifests, template rendering parity with upstream); not yet run end to end. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Update Dify API, web, and Agent images to 1.19.0 and the plugin daemon to 0.6.14-local. Start local_sandbox with --require-auth-token, trust the bundled Nginx client address on api/api_websocket, sync the Nginx templates (Host/port mapping, Human Input IM callback route), and wire the Access Token and HITL IM web flags. Hand plugin daemon storage to uid 1001 in init_permissions, since daemon 0.6.12+ runs as non-root (port of langgenius/dify#45615). Keep the single .env model instead of upstream envs/*.defaults; KnowledgeFS stays out. Document the 1.18/1.19 migrations, tracing queue, password pepper, and upgrade steps. Statically validated (compose config, image manifests); database migrations and the plugin storage handover are not yet run in a real environment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- bump core/koko/kael/chen/web to v5.1.1-ce and Redis to 7.4.12-bookworm - follow installer v5.1.1: drop CHAT_AI_DELEGATION_SECRET / Kael PLATFORM_DELEGATION_KEY (Kael 5.1 forwards the user's Core session) - add WS_ALLOWED_ORIGINS: Core 5.1 rejects browser WebSocket origins not derived from SITE_URL/DOMAINS, which blocks plain-HTTP access by default - update the offline image list in app/README.md - document the 5.0.0 -> 5.1.1 upgrade; runtime validation still on v5.0.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- insforge: update to v2.3.5 (dependency security fixes); PostgREST, Deno and the vendored functions/ runtime are unchanged upstream. Document migration 066, which adds owner policies and RLS to storage.objects when the table has no policies. - metabase: move from the frozen v0.64.1.x channel to v0.64.x (same image as v0.64-lts, 0.64.5.2 on 2026-11-06). - wiki: pin requarks/wiki:2 so the upcoming latest -> 3.x move cannot upgrade a 2.x deployment implicitly; Wiki.js 3.0 is now GA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the
app/templates that drifted from upstream since 2026-10-08 back in line. One commit per app:fix(supabase)0.8.2→0.8.4(security update)fix(dify)1.17.1→1.19.0, plugin daemon0.6.10-local→0.6.14-localapp(jumpserver)v5.0.0-ce→v5.1.1-ce, Redis7.4.11→7.4.12fix(app)v2.3.5; Metabasev0.64.1.x→v0.64.x; Wiki.js pinned torequarks/wiki:2Matching doc updates are on the
app/upstream-2026-11branches ofpigsty.ioandpigsty.cc.Why
v0.64.1.xtag stopped receiving builds on 2026-10-12;v0.64.x(=v0.64-lts) tracks 64.5.x.3tag is published. The untagged image still resolves to 2.5, but once upstream moveslatest,make upwould pull a major rewrite onto an existing 2.x database.requarks/wiki:2matches the README's "major-version tag" policy.What reviewers should look at
1.50.15(upstream:≥1.52breaks Studio log queries on the PG backend). Gateway changes are ported to both Envoy and Kong (function-owned CORS on/functions/v1/,sb_key →sb-api-keytranslation, new OAuth/OIDC discovery routes), keeping the Pigsty/pg/CORS restriction. AddsFUNCTIONS_MEMORY_LIMIT(2g) andmemory-pressure.ts. No new SQL: upstreamdocker/volumes/db/is identical between 0.8.2 and 0.8.4. Storage migrations are one-way, so back up first; the README says so..env+apps.dify.confmodel instead of upstream's newdocker/envs/**/*.defaultslayout.local_sandboxnow runs with--require-auth-token(a non-emptyDIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKENis required since 1.18).init_permissionsalso chowns the plugin daemon storage to uid 1001, because daemon 0.6.12+ runs as a non-rootdifyuser. This ports the unmerged fix(docker): initialize plugin daemon storage permissions langgenius/dify#45615; uid 1001 checked against theubuntu:24.04base, which already hasubuntuat 1000. KnowledgeFS is left out (optional, separate DB, amd64-only).CHAT_AI_DELEGATION_SECRET/ KaelPLATFORM_DELEGATION_KEY). AddsWS_ALLOWED_ORIGINS, which is not in the installer diff: Core 5.1 rejects browser WebSocket origins not derived fromSITE_URL/DOMAINS, and with the default loopbackSITE_URL, scheme-lessDOMAINSonly allowhttps://. Without the new setting, plain-HTTP access breaks task logs and job output. Checked againstapps/jumpserver/ws_origin.pyat v5.1.1. An empty or invalid value makes Core fail at startup (documented).functions/is unchanged from v2.3.3, so the vendored snapshot stays. The new migration 066 adds owner policies and RLS tostorage.objectsonly when it has no policies; this is documented.proxy_read_timeout 120s(roles/infra/templates/nginx/endpoint.conf) is shorter than the Supabase Functions 150s idle timeout.Validation
docker compose configpasses for supabase (default, kong, asymmetric, kong+asymmetric), dify, jumpserver, insforge, metabase, wiki.docker manifest inspectconfirms every new image tag (JumpServer on both the Aliyun mirror and Docker Hub)./pg/adaptation.conf/app/*.ymlparse with PyYAML and are byte-identical to the doc-siteconf/yaml/mirrors;git diff --checkclean.Not yet run in a real environment: full-stack end-to-end runs of all three stacks; Supabase Storage/Auth migrations on an existing database; Dify 1.17.1 → 1.19.0 migrations and the plugin storage chown; JumpServer in-place upgrade and WebSocket checks from each access URL.
🤖 Generated with Claude Code