Upgrade etherpad

etherpad/application.yaml

@@ -28,7 +28,13 @@ spec:
     spec:
       containers:
         - name: etherpad
-          image: mirror.gcr.io/etherpad/etherpad:2
+          # Pinned exactly: the mutable :2 tag stopped booting offline. 2.x runs
+          # `pnpm run prod`, and pnpm 11 re-checks deps before every run, so it
+          # tried to fetch typescript at startup and died against the egress
+          # NetworkPolicy. Fixed upstream in 3.0.0 (runtime pnpm bypass, #7718)
+          # and 3.3.0 (air-gapped boot, #7911). 3.3.3 also closes a pre-auth
+          # arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5).
+          image: mirror.gcr.io/etherpad/etherpad:3.3.3
           securityContext:
             # Etherpad writes session key during start
             readOnlyRootFilesystem: false
@@ -39,8 +45,21 @@ spec:
           env:
             - name: MINIFY
               value: 'false'
+            # No egress to the internet here, so switch off every outbound call
+            # rather than letting them fail (knobs added upstream in 3.3.2).
+            - name: UPDATES_TIER
+              value: 'off'
+            - name: PRIVACY_UPDATE_CHECK
+              value: 'false'
+            - name: PRIVACY_PLUGIN_CATALOG
+              value: 'false'
             - name: DB_TYPE
               value: mysql
+            # Without this ueberDB logs "not configured with charset undefined --
+            # may lead to crashes when certain characters are pasted". Verified
+            # against a restore of prod data that exports stay byte-identical.
+            - name: DB_CHARSET
+              value: utf8mb4
             - name: DB_HOST
               value: mariadb
             - name: DB_NAME