chore(deps): update all non-major dependencies

2026-11-02 03:01:52 +00:00
19 changed files with 24 additions and 24 deletions
@@ -48,7 +48,7 @@ spec:
        # cert when doing server-side OIDC token exchange. Bundle both
        # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
          command:
            - sh
            - -c
@@ -28,7 +28,7 @@ spec:
      enableServiceLinks: false
      containers:
        - name: evcc
-          image: evcc/evcc:0.318.1@sha256:2f8163ab22f04863afd86cd511c09607ba71debd9eebd65511f3d654922a80d1
+          image: evcc/evcc:0.318.2@sha256:7ef9bcb15a4fdbfe3bf75d7a0857c40b6272b8783ea833fcbb22f8f134b336c7
          # evcc auto-discovers /etc/evcc.yaml on its default search path;
          # the file is delivered (with the MQTT password) via the
          # sops-encrypted evcc-config Secret mounted below.
@@ -88,7 +88,7 @@ spec:
        # deliver, and the ClusterIP has no backend while HA restarts. The
        # trap forwards SIGTERM so the pod still terminates promptly.
        - name: socat-ipv4
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -130,7 +130,7 @@ spec:
        # depends on the kernel's bindv6only default rather than on anything
        # stated here, so the roles are made explicit instead of inherited.
        - name: socat-ipv6
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
@@ -66,7 +66,7 @@ spec:
        # The library PVC is populated by the seed phase before this
        # Deployment reconciles, so no rsync init is needed here.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.23.0@sha256:11e64e28c5f58c8d93ee95fcf22ac055f48b0bc440e0ce7d8013bbb5ad6aa8ac
+          image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
          command:
            - sh
            - -c
@@ -48,7 +48,7 @@ spec:
            # this sentinel: the entrypoint copies AccountsSettings.json
            # into ephemeral /config-internal rather than symlinking it.
            - name: seed-config
-              image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+              image: busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
              command: ["/bin/sh", "-eu", "-c"]
              args:
                - |
@@ -94,7 +94,7 @@ spec:
            - name: libation
              # Pinned by digest: Spegel caches mutable tag resolutions, so
              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
-              image: docker.io/rmcrackan/libation:14.2.2@sha256:fe188ac3c4ce63cc305971c76e648748341427e16bcf884011da8a384fd3908c
+              image: docker.io/rmcrackan/libation:14.2.5@sha256:7bb47a417311d154c6691747320d0b62ce15527280ad99f0e2a85ac9a6b07e40
              # The entrypoint stages config into ephemeral /config-internal
              # by copy (only the DB is symlinked to the PVC), so Audible
              # tokens refreshed during a run are lost at container exit.
@@ -72,7 +72,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.32@sha256:f8700633d4336258af7a05b53865a4f479e0d628cf2d9ca83d28b5939314d4ce
+          image: ghcr.io/element-hq/element-web:v1.12.33@sha256:b0aa4b5a4fc1afaaff62e2dbd0c92d57e2b20724f3ccb2fef53aae949088c3d2
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -137,7 +137,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1@sha256:02712e68c90f3743fedbd5e3343517481b2b4f246a9fd9e2f050dc2553033847
+          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0@sha256:494c67f08ee8344368f4ed336611dea02b26c4e058bf37a212d090d50b612659
          # The server applies database migrations and syncs the upstream
          # providers from the config on start.
          args: ["server", "--config", "/config/config.yaml"]
@@ -179,7 +179,7 @@ spec:
        # first. The marker on the data PVC makes later starts skip it.
        # Debug image: the plain one has no shell for the marker check.
        - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.27.1-debug@sha256:75f369b206785f1480f4a9f8dd81d7f9f3c6793c40fd184358ecd5d7acae17d4
+          image: ghcr.io/element-hq/matrix-authentication-service:1.28.0-debug@sha256:362b8cc6b1176aec059f3539da2d47c8b47587d1584431bf1aca285146d42b08
          command:
            - /busybox/sh
            - -ec
@@ -234,7 +234,7 @@ spec:
              mountPath: /data
      containers:
        - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.163.2@sha256:c3c21919a322f74d177a43bce8031adc81ef839ddd117a8dd03cfec350e76e02
+          image: ghcr.io/element-hq/synapse:v1.164.1@sha256:fa4aa980f279bcf26d4e7ecc2a2c9a701c73f2ebe8841da9bdcf3b2fdf693d75
          # Bypass /start.py: it expects to run as root and template a config
          # from env. Default mode is generate-missing-and-run, which creates
          # the signing key on first start.
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: "92.13.1"
+      version: "92.17.0"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -74,7 +74,7 @@ spec:
          # alpine/kubectl is the maintained replacement. Pin the tag
          # to the cluster's server version so kubectl is in lock-step
          # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.37.1@sha256:a5d0fbecab3f7b6c2ab7398f1daa73a3e0ed6ece18556d21698233e9e3759cc7
+          image: docker.io/alpine/kubectl:1.37.2@sha256:5e2de75d37e811ba6eb92e06890b1b3263eae4f0a1c17b49269edec589b1352a
          env:
            - name: DATASET_TLV
              valueFrom:
@@ -47,7 +47,7 @@ spec:
        #
        # Hence socat is installed at startup and run inside this container.
        - name: otbr
-          image: openthread/otbr:latest@sha256:f3e43ccd86d6da87323873efa0c9b6f92a2a8cc75a804ea50e34c96680363e2e
+          image: openthread/otbr:latest@sha256:51f9af250252f4faae85d0197574a7c17ada873c78799854461a93e3e42cf324
          command:
            - bash
            - -c
@@ -287,7 +287,7 @@ spec:
              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
        # anchor: bridge-tls-proxy
        - name: bridge-tls-proxy
-          image: alpine/socat:1.8.1.3@sha256:603174b77eebaba25ba8f8ebb15e1234d6600409554e95d6fb203fd106150287
+          image: alpine/socat:1.8.1.3@sha256:466c8a0383e16463fabdb7df01008292fb78d07da60224a46cb5d3142ce122ed
          args:
            - "-d"
            - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"
@@ -59,7 +59,7 @@ spec:
            - name: renovate
              # Pinned by tag and digest. Renovate updates itself through
              # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.181.8@sha256:b28b2de1dfd35de7e8198756d7f7cdd84ebc28c3f25e80f5b09e598d3faefb2a
+              image: docker.io/renovate/renovate:44.199.2@sha256:0538f498be1b074e2434f8449cab7b2be30f8c0d0baf3b72814010f19db5bcfb
              env:
                - name: RENOVATE_CONFIG_FILE
                  value: /config/config.json
@@ -57,7 +57,7 @@ spec:
          # Pinned, and deliberately NOT under Flux image automation. rbac.yaml
          # is derived from what this exact version calls; an automatic bump
          # could add a call the Role does not cover, silently.
-          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.13@sha256:3301afb61c10abc4e334deab9cd8601cef069e352b4d7f4dd0897787fca32eac
+          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.14@sha256:6d7b7fcb39d72296b6b6c0301b443fb31e12d86c55e706adcc7e4f92a887a3ba
          command: ["/manager"]
          args:
            - --health-probe-bind-address=:8081
@@ -68,7 +68,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: sync
-              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
              command:
                - sh
                - -c
@@ -128,7 +128,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: run
-              image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
+              image: curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
              command:
                - sh
                - -c
@@ -25,7 +25,7 @@ spec:
        fsGroup: 33
      containers:
        - name: wordpress
-          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
+          image: wordpress:7.1.4-php8.5-apache@sha256:131532d893b5dc4fdf4312a878b7e5e4e4d1d40eb54c854c78eddf6282457dfb
          ports:
            - name: http
              containerPort: 80
@@ -69,7 +69,7 @@ spec:
          # first build of that day — imagePullPolicy: Always does not help,
          # because the tag itself resolves stale. Update this when the image
          # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
+          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
          command: ["/bin/sh", "-c"]
          args:
            - |
@@ -95,7 +95,7 @@ spec:
              mountPath: /etc/bird
      containers:
        - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:65fc93efead1e9b065d2c78e748f6c3c1ad7216e28b757d9fa4e204fa2ffe9a9
+          image: gitea.renner.uno/gitea_admin/bird@sha256:fee5645ad0d718661fb90da6ea9090d30fe47597bebeecb246c01c2adc6df585
          resources:
            requests:
              cpu: "50m"
@@ -2,7 +2,7 @@
 #
 # Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
 # (the binary has no shell and no package manager to patch or to exec).
-FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
+FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build

 WORKDIR /build
 COPY go.mod go.sum ./
@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.99-alpine@sha256:b1d5dd5a22a09404d3e798c0cf051b689077360374eb505fa5bb93c479693d87 AS build
+FROM rust:1.99-alpine@sha256:7e9e2d068a107a2adafd19930011178d14a78326053cd4c3a9f7ad3fd049557d AS build

 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.