Update immich to v3.3.5 (CVE/CA compromise fix)

Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>

CHANGELOG.md

@@ -565,43 +565,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-10-23
-
-### 💾 Core
-
-  - error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
-- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
-- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
-- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
-
-## 2026-10-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
-
-### 💾 Core
-
-  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
-- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
-
 ## 2026-10-21
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
-    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
     - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
 
 ### 💾 Core

ct/cryptpad.sh

@@ -30,14 +30,12 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
-  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
   if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
     msg_info "Stopping Service"
     systemctl stop cryptpad
     msg_ok "Stopped Service"
 
-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
 
     CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
@@ -47,30 +45,8 @@ function update_script() {
     cd /opt/cryptpad
     $STD npm ci --allow-git=all
     $STD npm run install:components
-    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
-      $STD bash /opt/cryptpad/install-office.sh --accept-license
-    fi
-    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
-      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
-      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
-const c = require("/opt/cryptpad/config/config.js");
-const i = require("/opt/cryptpad/config/infra.example.js");
-const port = c.httpPort || i.public.httpPort;
-const safePort = c.httpSafePort || port + 1;
-const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
-const sandbox = new URL(origin);
-sandbox.port = safePort;
-Object.assign(i.public, {
-  origin,
-  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
-  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
-  httpPort: port,
-  httpSafePort: safePort,
-  externalWebsocketURL: c.externalWebsocketURL,
-  fileHost: c.fileHost,
-});
-require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
-EOF
+    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
+      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
     fi
     $STD npm run build
     msg_ok "Updated CryptaPad"

ct/sparkyfitness.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"

ct/zabbix.sh

@@ -46,36 +46,24 @@ function update_script() {
     msg_warn "No Zabbix Agent service found, skipping agent actions"
   fi
 
-  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
-  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
-  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
-  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
-      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
-      exit 75
-    fi
-    ZABBIX_VERSION="$ZABBIX_SERIES"
-    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
-  else
-    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-    case "$ZABBIX_CHOICE" in
-    1) ZABBIX_VERSION="7.0" ;;
-    2) ZABBIX_VERSION="7.4" ;;
-    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-    *)
-      ZABBIX_VERSION="7.4"
-      echo "Invalid choice. Defaulting to 7.4."
-      ;;
-    esac
-  fi
-
   msg_info "Stopping Services"
   systemctl stop zabbix-server
   [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
   msg_ok "Stopped Services"
 
+  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+  case "$ZABBIX_CHOICE" in
+  1) ZABBIX_VERSION="7.0" ;;
+  2) ZABBIX_VERSION="7.4" ;;
+  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+  *)
+    ZABBIX_VERSION="7.4"
+    echo "Invalid choice. Defaulting to 7.4."
+    ;;
+  esac
+
   msg_info "Updating Zabbix to $ZABBIX_VERSION"
   mkdir -p /opt/zabbix-backup/
   cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/

install/cryptpad-install.sh

@@ -28,15 +28,11 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-office.sh --accept-license"
+  $STD bash -c "./install-onlyoffice.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-cp config/infra.example.js config/infra.js
-sed -i \
-  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
-  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
-  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
-  config/infra.js
+sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
+sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
 $STD npm run build
 msg_ok "Setup CryptPad"
 

install/kasm-install.sh

@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"
 
 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
+KASM_URL=$(curl -s https://kasm.com/downloads \
   | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1 || true)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)
+  | head -1)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')
 
 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -63,7 +63,7 @@ curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
+printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
   /^Kasm UI Login Credentials$/ {capture=1}
   capture {print}