[ChiragAgg5k]

The chart's Console image 1.2.97-self-hosted contains DOMPurify 3.4.16 and triggers code-scanning alerts #6363 (critical) and #6364 (high). Update the default Console image to 1.2.106-self-hosted, built from appwrite/appwrite#14892 with DOMPurify 3.4.17. Regenerate the chart README and image catalog, and record the security update in the unreleased changelog.

Reports: https://github.com/appwrite/helm-chart/security/code-scanning/6363 and https://github.com/appwrite/helm-chart/security/code-scanning/6364.

Validation:

• 255 chart unit tests pass.
• Strict Helm lint passes for every CI values scenario.
• Kubeconform validates all configured scenarios across Kubernetes 1.29, 1.32, 1.35 and 1.37.
• make generate, example configurations, generated-file freshness, image catalog sync, changelog annotation check and git diff --check pass.
• Published self-hosted image has AMD64 and ARM64 manifests. Trivy scan of the published AMD64 digest sha256:00d25310298295db670e9d9b17b2c71a5ca6160b922fd32facaf39238a6d2109 confirms app/node_modules/dompurify/package.json is 3.4.17 and neither targeted advisory remains. One unrelated library advisory remains; this PR does not claim a clean scan.

Console release: https://github.com/appwrite/appwrite/actions/runs/39972771169

Continues appwrite-labs/infrastructure#896. The patched image is published and verified. Rescan after merge before considering the reports resolved.

[hansi-codes]

🟢 Tier S · Ready to merge

The schema description matches the source values documentation and introduces no behavior change.

The chart now defaults to the Console image 1.2.106-self-hosted, which includes the DOMPurify security fixes, while keeping the Console version independent of Appwrite's appVersion. The generated image catalog and chart documentation reflect the updated image, and the unreleased changelog records the security update.

Latest changes: The latest commit regenerates the values schema description to clarify that the Console image tag is pinned independently from appVersion so Console security updates can ship separately.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 5

File	Change
CHANGELOG.md	Records the Console image's DOMPurify security update under Unreleased.
charts/appwrite/Chart.yaml	Updates the Artifact Hub image catalog to the patched Console image.
charts/appwrite/README.md	Regenerates the Console image tag documentation and explains its independent versioning.
charts/appwrite/values.schema.json	Regenerates the Console image-tag description to clarify independent versioning.
charts/appwrite/values.yaml	Sets the default Console image to 1.2.106-self-hosted and documents its independent versioning.

---

_{Reviewed the commits since 35c5267 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary