From f2edaa30e4dd330d8dbc408bb96cbf133c33484a Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 15:37:23 +0000 Subject: [PATCH] Advance chart to 1.7.1 for native Server 3.9.2 --- k8s/helm/durable-workflow/Chart.yaml | 14 +++++----- k8s/helm/durable-workflow/README.md | 2 +- k8s/helm/durable-workflow/docs/UPGRADING.md | 30 +++++++++++++++++++++ k8s/helm/durable-workflow/values.yaml | 2 +- resources/release/source-release.json | 4 +-- 5 files changed, 41 insertions(+), 11 deletions(-) diff --git a/k8s/helm/durable-workflow/Chart.yaml b/k8s/helm/durable-workflow/Chart.yaml index 06e3364c5..230a7eccf 100644 --- a/k8s/helm/durable-workflow/Chart.yaml +++ b/k8s/helm/durable-workflow/Chart.yaml @@ -5,11 +5,11 @@ type: application # The chart's own semver version. Bumped on every chart release; treated as # independent of the server image version (appVersion). Breaking-change rules # for this version live in docs/UPGRADING.md alongside the chart. -version: 1.7.0 +version: 1.7.1 # The immutable native Durable Workflow Server this chart release packages. # The onboarding default in values.yaml and appVersion are generated from the # checked-in source release record (helm_chart.app_version). -appVersion: "3.9.1" +appVersion: "3.9.2" kubeVersion: ">=1.27.0-0" home: https://durable-workflow.github.io/docs/2.0/deployment sources: @@ -30,16 +30,16 @@ annotations: # exact commit that most recently changed the packaged chart. org.opencontainers.image.source: https://github.com/durable-workflow/server dev.durable-workflow.source-revision: "unreleased" - dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:3.9.1" + dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:3.9.2" artifacthub.io/license: MIT artifacthub.io/category: integration-delivery # Free-form changelog for the current chart release shown by Artifact Hub. artifacthub.io/changes: | - kind: changed - description: "Default image changes from native Server 3.8.0 to 3.9.1. Every backend needs a schema upgrade (SQLite 12 to 13, PostgreSQL and MariaDB 13 to 14, MySQL 14 to 15) that only creates the empty dw_command_intents table. Scale to zero, back up, run helm upgrade with native.schemaUpgrade.enabled=true, scale up; rolling back means restoring the backup (docs/UPGRADING.md)." - - kind: added - description: "Server 3.9.1: signal and update request_id values are durable command keys; reusing a key with different input returns 409 request_id_conflict. A run's own close settles its open activities and timers. https://github.com/durable-workflow/server/releases/tag/3.9.1" + description: "Default image advances from native Server 3.9.1 to 3.9.2. No schema step from 3.9.0 or 3.9.1; upgrades from 3.8.x or earlier keep the explicit 3.9 schema/backup/restore procedure in docs/UPGRADING.md." + - kind: fixed + description: "Server 3.9.2 accepts 255-code-point multibyte command keys and echoes literal keys with explicit fresh/retained intent metadata. Installed client acceptance remains separately qualified. https://github.com/durable-workflow/server/releases/tag/3.9.2" - kind: changed - description: "Server 3.9.1 honors the configured storage-admission observation: draining refuses new work while existing leases can finish; fenced permits only reads. Completion uploads during draining remain unavailable (server#951)." + description: "Storage-admission observation ownership is checked on the opened descriptor against root or the effective Server UID. Trusted ancestors remain operator-required; draining uploads and Cloud adoption remain separate (server#951)." - kind: fixed description: "Legacy command-key readback identifies unverified intent and refuses ambiguous identities. Oversized completion responses use a bounded drain, and discovery advertises the actual completion wire cap; installed SDK acceptance is tracked in shared#228." diff --git a/k8s/helm/durable-workflow/README.md b/k8s/helm/durable-workflow/README.md index e4cef0a9c..72079aa79 100644 --- a/k8s/helm/durable-workflow/README.md +++ b/k8s/helm/durable-workflow/README.md @@ -77,7 +77,7 @@ helm install durable-workflow ./k8s/helm/durable-workflow \ ```yaml image: - tag: "3.9.1" + tag: "3.9.2" # Pin a digest in production: # digest: "sha256:abc123..." diff --git a/k8s/helm/durable-workflow/docs/UPGRADING.md b/k8s/helm/durable-workflow/docs/UPGRADING.md index aa1c8b6da..18f4d2860 100644 --- a/k8s/helm/durable-workflow/docs/UPGRADING.md +++ b/k8s/helm/durable-workflow/docs/UPGRADING.md @@ -69,6 +69,36 @@ chart MINOR bump and an entry below. ## Per-version migration notes +### Chart 1.7.1 / Server 3.9.2 (native) + +Chart 1.7.1 selects the native Server 3.9.2 corrective image. From Server +3.9.0 or 3.9.1, no schema step is required: back up the database and external +payload storage, stop the Server replicas, apply the new chart/image and +verify readiness, reported version and worker registration. An explicit +`image.tag` or `image.digest` override must select the intended qualified image too. + +From 3.8.x or earlier, follow the schema-upgrade procedure below using the +3.9.2 image. The backend versions and restore-required rollback boundary are +unchanged. A rollback to 3.9.1 uses the same schema but restores its Unicode-key +and receipt-metadata defects and removes the observation-owner hardening. + +Server 3.9.2 accepts the existing 255-Unicode-code-point command-key boundary +for multibyte keys. Fresh keyed signal/accepted-update receipts echo the literal +`request_id` with `retained:false` and `intent_verified:true`; retained receipts +echo their key while preserving original identities and legacy unverified +intent. The body key remains distinct from the tracing header. Conflicts and +ambiguous identity matches still refuse without writes. + +An enabled storage-admission observation must belong to root or the effective +Server UID. Check the actual container mapping before rollout. Trusted parent +directories remain an operator requirement; the runtime does not validate +ancestors. This patch adds no draining-upload allowance or Cloud adoption. +The encoded completion budget and bounded refusal delivery are unchanged. +Installed client/physical upgrade acceptance under shared #216 and #228 stays +separate. The MariaDB reliability investigation #1204 remains open. + +See [Server 3.9.2 release notes](../../../../docs/releases/3.9.2.md). + ### Chart 1.7.0 / Server 3.9.1 (native) **From 3.8.x or earlier, every backend needs an explicit native schema upgrade.** Server 3.9.1 includes diff --git a/k8s/helm/durable-workflow/values.yaml b/k8s/helm/durable-workflow/values.yaml index cbb79d6c5..715f47bc4 100644 --- a/k8s/helm/durable-workflow/values.yaml +++ b/k8s/helm/durable-workflow/values.yaml @@ -42,7 +42,7 @@ image: # scripts/ci/sync-source-release.mjs. Do not edit this default. # A tag must match the runtime: 3.x (or latest) for native, 2.x for php. # The chart refuses a mismatch at render time. - tag: "3.9.1" + tag: "3.9.2" # Optional digest pin. When set, takes precedence over tag for change control. # Example: "sha256:abc123..." # The chart cannot see which runtime a digest names. Pin a native digest diff --git a/resources/release/source-release.json b/resources/release/source-release.json index ec8a4a7d2..da7f1a0b9 100644 --- a/resources/release/source-release.json +++ b/resources/release/source-release.json @@ -4,7 +4,7 @@ "version": "2.11.8" }, "helm_chart": { - "version": "1.7.0", - "app_version": "3.9.1" + "version": "1.7.1", + "app_version": "3.9.2" } }