From f4bfafee56d2a79dba53c70a35d2d784e7bfaa21 Mon Sep 17 00:00:00 2001 From: Stuart Date: Wed, 5 Aug 2026 18:59:40 +0200 Subject: [PATCH] Bump to upstream Invidious 2.20260804.1 Update the pinned upstream images from the 2026-06-26 release, which was ~6 weeks stale and hitting the recurring upstream YouTube "non 200 status code / status code 400" on the browse path (trending/search). That path is the main Invidious process talking to YouTube's InnerTube API directly -- distinct from the companion, which handles video streams and was working. The fix for this class of break is an upstream release, not a config change: po_token/visitor_data are no longer config fields, and token generation is the companion's job. - Dockerfile: both FROM lines 2.20260626.0 -> 2.20260804.1 (+ -arm64). The .1 is a same-day hotfix of the 2026-08-04 release that only restores debug symbols in the OCI build -- no behavior change, strictly preferable. - Companion: master-5652eda -> 2026.08.03-438c668. Upstream retired the master- tag scheme around June 2026 in favor of immutable YYYY.MM.DD- build tags; the pin comment is corrected to match. - current.ts: 2.20260804.1:0 + release notes in all five languages. New upstream version, no data migration, so current.ts is edited in place rather than spun off; VersionGraph handles the in-place upgrade from the installed 2.20260626.0:0. config.yml.ts is unchanged. Diffing upstream config.example.yml across the two releases, the only additions are optional keys with upstream defaults (disable_abusable_api, a videojs buffer block, socks5 proxy support) and all ten keys this package manages still exist -- so nothing mandatory changed. The optional keys are noted in TODO.md as possible future action toggles. Verified: tsc + SDK lint clean, ncc builds, both arches pack, built manifests report version 2.20260804.1:0 / sdkVersion 2.0.6. The three image tags were confirmed present on quay before building. Device-tested by the maintainer as an in-place upgrade over 2.20260626.0_0: the browse path and playback both check out. Co-Authored-By: Claude Opus 4.8 --- Dockerfile | 4 ++-- TODO.md | 8 +++++--- startos/manifest/index.ts | 8 +++++--- startos/versions/current.ts | 17 +++++++++++------ 4 files changed, 23 insertions(+), 14 deletions(-) diff --git a/Dockerfile b/Dockerfile index a8a399b..19582c1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,8 +2,8 @@ # quay.io/invidious/invidious: amd64 # quay.io/invidious/invidious:-arm64 arm64 # This Dockerfile pins both and lets buildx pick by TARGETARCH. -FROM quay.io/invidious/invidious:2.20260626.0 AS base-amd64 -FROM quay.io/invidious/invidious:2.20260626.0-arm64 AS base-arm64 +FROM quay.io/invidious/invidious:2.20260804.1 AS base-amd64 +FROM quay.io/invidious/invidious:2.20260804.1-arm64 AS base-arm64 ARG TARGETARCH FROM base-${TARGETARCH} diff --git a/TODO.md b/TODO.md index 3805cdf..036107d 100644 --- a/TODO.md +++ b/TODO.md @@ -1,14 +1,16 @@ # TODO -- [ ] Device-test on StartOS. **Verified 2026-07-20** (SDK 2.0.6, x86_64): fresh install, all three daemons start, `check_tables` builds the schema, companion generates and validates a PO token, **video playback**, **account creation**, and the **Configure Invidious action** (toggles apply, `.const()` fires the reactive restart, db volume persists). Crucially, an authenticated `200 GET /api/v1/auth/subscriptions` *after* that restart confirms all three generated secrets survive `merge()` — `hmac_key` (session cookie still valid), the db password (postgres skips re-init and keeps its original password, so a regenerated one would fail auth), and `invidious_companion_key` (companion logs an identical `secret_key`). **Still to exercise: backup and restore** (`pg_dump` has never run on this package). +- [ ] Device-tested on StartOS (x86_64), record of what's been exercised: + - **2026-07-20** (v2.20260626.0_0, SDK 2.0.6): fresh install, all three daemons start, `check_tables` builds the schema, companion generates/validates a PO token, **video playback**, **account creation**, the **Configure Invidious action** (toggles apply, `.const()` fires the reactive restart, db volume persists), **secret survival** across that restart (an authenticated `200 GET /api/v1/auth/subscriptions` proves `hmac_key`, the db password, and `invidious_companion_key` all survive `merge()`), and **backup/restore**. + - **2026-08-05** (in-place upgrade to v2.20260804.1_0): the browse path (trending/search — the thing that had been throwing the upstream YouTube 400) and playback, verified by the maintainer. +- [ ] Consider exposing the new upstream optional config keys as Configure-Invidious toggles if users ask: `disable_abusable_api` (blocks easily-spammed `/api/v1/videos|clips|transcripts`, for public instances) and the `videojs` buffer lengths (`goal_buffer_length`/`max_goal_buffer_length`). Both arrived in v2.20260804.0 with upstream defaults, so absent from our `config.yml.ts` they simply take those defaults — no action required, just optional surface area. - [ ] Consider `runAsInit: true` on the invidious and companion daemons. Both images use tini, which warns at startup that it is not PID 1 and therefore cannot reap zombies. `exec.runAsInit` makes the SDK `launch()` the command as PID 1 instead of `spawn()`ing it. Not urgent and not a 2.0 regression — but it changes signal delivery and teardown, so it needs its own device test. - [ ] Low priority: on **first boot only**, ~24s elapses between postgres reporting ready and invidious launching (2026-07-20: postgres ready 14:07:54, `Launching invidious...` 14:08:18). A restart the same day showed a 2s gap (14:20:55 → 14:20:57), so this is not a per-start cost — it looks like the `pg_isready` poll landing unluckily after `initdb`'s long first run, not a wiring problem. Only worth chasing if a user reports a slow first start. - [ ] Consider a "Set Primary URL" action wired to `external_port`/`domain` if users report broken absolute URLs (RSS, OAuth-style flows). -- [ ] Watch upstream for versioned companion tags to replace the pinned `master-`. ## Known benign log noise -Both of these look like failures and will be reported as bugs; neither is one. +These look like failures and will be reported as bugs; none is one. - `ERROR: relation "" does not exist` (×8) on **first start only** — this is `check_tables` probing each table with `SELECT * FROM x LIMIT 0` and creating the ones that error. It is the mechanism replacing upstream's `init-invidious-db.sh`. - `InstanceListRefreshJob: failed to parse information from ''` — Invidious fetching the public instance list and choking on Yggdrasil-network entries. Upstream noise. diff --git a/startos/manifest/index.ts b/startos/manifest/index.ts index b668bf5..83bbaf4 100644 --- a/startos/manifest/index.ts +++ b/startos/manifest/index.ts @@ -20,11 +20,13 @@ export const manifest = setupManifest({ }, arch: ['x86_64', 'aarch64'], }, - // Companion publishes no version tags — only `latest` and rolling - // `master-` tags. Pin the current master sha for reproducibility. + // Companion has no release tags; upstream publishes immutable + // `YYYY.MM.DD-` build tags (plus `latest`). Pin a dated build for + // reproducibility. (The older `master-` scheme was retired ~Jun 2026.) companion: { source: { - dockerTag: 'quay.io/invidious/invidious-companion:master-5652eda', + dockerTag: + 'quay.io/invidious/invidious-companion:2026.08.03-438c668', }, arch: ['x86_64', 'aarch64'], }, diff --git a/startos/versions/current.ts b/startos/versions/current.ts index 1785789..183cc2a 100644 --- a/startos/versions/current.ts +++ b/startos/versions/current.ts @@ -1,13 +1,18 @@ import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk' export const current = VersionInfo.of({ - version: '2.20260626.0:0', + version: '2.20260804.1:0', releaseNotes: { - en_US: 'Initial release of Invidious 2.20260626.0 for StartOS.', - es_ES: 'Versión inicial de Invidious 2.20260626.0 para StartOS.', - de_DE: 'Erste Version von Invidious 2.20260626.0 für StartOS.', - pl_PL: 'Pierwsze wydanie Invidious 2.20260626.0 dla StartOS.', - fr_FR: 'Version initiale de Invidious 2.20260626.0 pour StartOS.', + en_US: + 'Updates Invidious to 2.20260804.1 and refreshes the bundled companion. Comment rendering in videos and community posts is fixed, new interface languages are added, and the package tracks the latest upstream YouTube-compatibility work.', + es_ES: + 'Actualiza Invidious a 2.20260804.1 y renueva el companion incluido. Se corrige la representación de los comentarios en vídeos y publicaciones de la comunidad, se añaden nuevos idiomas de interfaz y el paquete incorpora las últimas correcciones de compatibilidad con YouTube.', + de_DE: + 'Aktualisiert Invidious auf 2.20260804.1 und erneuert den mitgelieferten Companion. Die Darstellung von Kommentaren in Videos und Community-Beiträgen wird korrigiert, neue Oberflächensprachen kommen hinzu, und das Paket übernimmt die neuesten Upstream-Korrekturen zur YouTube-Kompatibilität.', + pl_PL: + 'Aktualizuje Invidious do wersji 2.20260804.1 i odświeża dołączony companion. Naprawiono wyświetlanie komentarzy w filmach i wpisach społeczności, dodano nowe języki interfejsu, a pakiet zawiera najnowsze poprawki zgodności z YouTube.', + fr_FR: + "Met à jour Invidious vers 2.20260804.1 et actualise le companion inclus. Le rendu des commentaires dans les vidéos et les publications de la communauté est corrigé, de nouvelles langues d'interface sont ajoutées, et le paquet intègre les dernières corrections de compatibilité avec YouTube.", }, migrations: { up: async () => {},