From 9ad15aa58f037df2b4585648f1ab330986152698 Mon Sep 17 00:00:00 2001 From: Erki Aas Date: Sun, 23 Aug 2026 14:24:51 +0300 Subject: [PATCH] Upgrade etherpad --- etherpad/application.yaml | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/etherpad/application.yaml b/etherpad/application.yaml index 4e3b31e..b0681c3 100644 --- a/etherpad/application.yaml +++ b/etherpad/application.yaml @@ -28,7 +28,13 @@ spec: spec: containers: - name: etherpad - image: mirror.gcr.io/etherpad/etherpad:2 + # Pinned exactly: the mutable :2 tag stopped booting offline. 2.x runs + # `pnpm run prod`, and pnpm 11 re-checks deps before every run, so it + # tried to fetch typescript at startup and died against the egress + # NetworkPolicy. Fixed upstream in 3.0.0 (runtime pnpm bypass, #7718) + # and 3.3.0 (air-gapped boot, #7911). 3.3.3 also closes a pre-auth + # arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5). + image: mirror.gcr.io/etherpad/etherpad:3.3.3 securityContext: # Etherpad writes session key during start readOnlyRootFilesystem: false @@ -39,8 +45,21 @@ spec: env: - name: MINIFY value: 'false' + # No egress to the internet here, so switch off every outbound call + # rather than letting them fail (knobs added upstream in 3.3.2). + - name: UPDATES_TIER + value: 'off' + - name: PRIVACY_UPDATE_CHECK + value: 'false' + - name: PRIVACY_PLUGIN_CATALOG + value: 'false' - name: DB_TYPE value: mysql + # Without this ueberDB logs "not configured with charset undefined -- + # may lead to crashes when certain characters are pasted". Verified + # against a restore of prod data that exports stay byte-identical. + - name: DB_CHARSET + value: utf8mb4 - name: DB_HOST value: mariadb - name: DB_NAME