[EwanDawson]

Summary

This PR moves hetzner/versions.lock from upstream 9a6cb3f to 65e8643 (block/buzz main, 2026-11-09). The newest commit, 22d96d9, isn't used because its image hasn't been published yet. Postgres, Redis, Silo and mc pins are unchanged. Only the relay image changes.

It is stacked on #1, because the fork's main doesn't have hetzner/ yet. Merge #1 first, then retarget this PR to main. Merging is the approval to deploy. After that, bin/deploy main takes a pre-upgrade backup, migrates, smoke-tests, and rolls back the relay image on failure.

Upstream changes (37 commits; relay-side highlights)

• Recover interrupted default-channel auto-joins ([buzz] Recover interrupted default-channel auto-joins block/buzz#9045)
• Revoke private channel attachment reads (fix(media): revoke private channel attachment reads block/buzz#9077). This is behind BUZZ_MEDIA_READ_MODE, which defaults to off.
• NIP-FI community policy management (Manage community NIP-FI policy with enable, disable and status block/buzz#9176, Allow operators to set initial NIP-FI policy on create block/buzz#9211)
• Route live REQ events by each filter's own channel scope (fix(relay): route live REQ events by each filter's own channel scope block/buzz#8519)
• Multi-node fan-out made concurrent and lossless (fix(relay): deliver multi-node fan-out concurrently and never drop silently block/buzz#9195). Membership caching (Cache channel memberships once per user block/buzz#9060) and restriction-row caching (perf(relay): serve restriction rows for 10 s with cross-pod invalidation block/buzz#9199).
• Regenerate missing image thumbnails on request (fix(relay): regenerate missing image thumbnails on request block/buzz#9174)
• Record why connections close (Record why relay connections close and quiet close warnings block/buzz#9245). Send a User-Agent on WebSocket upgrades (feat: send a User-Agent on relay WebSocket upgrades block/buzz#9246).
• sqlx pinned to the fix for a cancelled BEGIN (Pin sqlx to the upstream fix for a cancelled BEGIN block/buzz#9192)
• CLI fixes (fix(cli): list DMs, attach any file, validate kinds, default the relay block/buzz#9168, feat(cli): manage sidebar sections with buzz sidebar sections block/buzz#9191, fix(cli): preserve attachments across successive edits block/buzz#9226), plus mobile and loadgen changes that don't affect the relay

Upstream has no crates/buzz-relay/CHANGELOG.md, so this list comes from the commit log.

Migrations

• 0084_default_channel_recovery.sql: adds a nullable column to relay_members.
• 0085_community_auth_policy.sql: adds three columns to community_auth_upgrades.
• 0086_private_media.sql: adds one partial index on events and two new tables. The index build is bounded by a 5 s statement timeout, which is trivial at our data size.

All three only add schema, with no backfills.

Config and compose

• deploy/compose/compose.yml: unchanged.
• .env.example: adds BUZZ_MEDIA_READ_MODE=off and renames BUZZ_NIP_FI_UPGRADES_ENABLED to BUZZ_NIP_FI_CHANGES. Our buzz.env sets neither, so the defaults apply.

No new env vars or manual steps are needed.

Testing

bin/bump resolved every digest from the registries. The deploy smoke test runs after merge. This PR changes no code.

---

---

Generated by Claude Code