chore(deps): update ci non-major #1345

2026-10-19T02:01:59Z

renovate-bot commented

2026-10-19 02:01:59 +00:00

This PR contains the following updates:

Package	Type	Update	Change
aquasec/trivy		digest	`af6acf9` → `2416d1f`
node (source)	final	digest	`ebfe2f9` → `44fce69`
python (source)	final	minor	`3.14-slim` → `3.15-slim`
python (source)	stage	minor	`3.14-slim` → `3.15-slim`

❗ Important

Release Notes retrieval for this PR were skipped because no github.com credentials were available.
If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | aquasec/trivy | | digest | `af6acf9` → `2416d1f` | | [node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/node)) | final | digest | `ebfe2f9` → `44fce69` | | [python](https://hub.docker.com/_/python) ([source](https://github.com/docker-library/python)) | final | minor | `3.14-slim` → `3.15-slim` | | [python](https://hub.docker.com/_/python) ([source](https://github.com/docker-library/python)) | stage | minor | `3.14-slim` → `3.15-slim` | > ❗ **Important** > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - Between 12:00 AM and 08:59 AM, only on Monday (`* 0-8 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit 2026-10-19 02:01:59 +00:00

chore(deps): update ci non-major

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

review-bot reviewed: comment

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

f8b98907e8

renovate-bot added 1 commit 2026-10-19 02:02:00 +00:00

chore(deps): update ci non-major

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

review-bot reviewed: comment

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

f8b98907e8

review-bot reviewed

2026-10-19 02:11:19 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-5-5, commit f8b98907e8dd32b69f1d4fa2b8c9a6e3950828dd.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

Renovate PR that moves four pinned digests: aquasec/trivy:latest (security-scan), node:24-alpine (claude image), and python:3.14-slim → 3.15-slim in the authentik-gate-sync, heating-can and netbird-service-sync Containerfiles. The PR is mergeable, its base is still the master tip (5ebf7a04), and master still carries the 3.14 digests, so nothing here is already merged or superseded. I found no verified defect. The main risk is operational: merging publishes a new heating-can:latest on Python 3.15 that the edge host pulls on its next converge.

⚪ Unverified

Digests. I could not check python:3.15-slim@sha256:2da67604…, node:24-alpine@sha256:44fce696… or trivy:latest@sha256:2416d1f7… against their registries; I have no registry tool. The Python digest is identical in all four Containerfiles, which is what Renovate produces for one tag.
Python 3.15 compatibility of the stdlib-only controllers. The imports in ci/images/authentik-gate-sync/controller.py and ci/images/netbird-service-sync/controller.py are hashlib, json, logging, os, sys, time, urllib.* and ssl. None looks removed, but I did not check the 3.15 changelog (Renovate skipped release notes). The authentik image runs its unittest suite as a build stage (Containerfile:8-11). The netbird image runs nothing at build time, so its first 3.15 run happens in the cluster.
heating-can on 3.15. The build self-test (ci/images/heating-can/Containerfile:101-108) only runs open3e --help and E3onCANcollect.py --help. Whether open3e and E3onCAN install with 3.15 wheels, and whether they behave on the bus, is not something my tools can check.
Trivy flags. .woodpecker/security-scan.yml:23,31,51 use --timeout, --scanners, --skip-db-update and --download-db-only. The trivy latest digest moves with this PR, and I could not read its release notes to confirm those flags are unchanged.
Branch lookup anomaly. get_by_branches for renovate/ci-minor-patch returned closed PR #1126 (merged 2026-10-05) with the same head SHA f8b98907. Master's authentik-gate-sync/Containerfile (blob 8353a7b1) and heating-can/Containerfile (blob bc53495e) still show 3.14 and match this diff's base lines. I am treating #1126's SHA as a stale record for the reused branch name, not as a merged change.

🟡 Suggestions

ansible/roles/heating-can/defaults/main.yml:67 sets heating_can_image: gitea.renner.uno/gitea_admin/heating-can:latest. ansible/roles/heating-can/tasks/main.yml:154-166 runs docker compose pull and up -d on every converge. Merging touches ci/images/heating-can/**, which .woodpecker/build-ci-images.yml builds on master push, so :latest is republished on Python 3.15. The next converge then recreates the containers that read the heat-pump bus, and the only pre-deploy check is the --help self-test. Before that converge, run the new image once by hand against the bus, or pin heating_can_image to the pre-bump dated tag until that run is done.

Tests

No code changed, so no new tests are expected. The authentik unittest stage (ci/images/authentik-gate-sync/Containerfile:8-11) runs under 3.15 at build time and gates that image. The heating-can self-test proves only that the binaries start, which is the gap raised in the suggestion above.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-haiku-5-5`, commit `f8b98907e8dd32b69f1d4fa2b8c9a6e3950828dd`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary Renovate PR that moves four pinned digests: `aquasec/trivy:latest` (security-scan), `node:24-alpine` (claude image), and `python:3.14-slim` → `3.15-slim` in the authentik-gate-sync, heating-can and netbird-service-sync Containerfiles. The PR is mergeable, its base is still the master tip (`5ebf7a04`), and master still carries the 3.14 digests, so nothing here is already merged or superseded. I found no verified defect. The main risk is operational: merging publishes a new `heating-can:latest` on Python 3.15 that the edge host pulls on its next converge. ## ⚪ Unverified - **Digests.** I could not check `python:3.15-slim@sha256:2da67604…`, `node:24-alpine@sha256:44fce696…` or `trivy:latest@sha256:2416d1f7…` against their registries; I have no registry tool. The Python digest is identical in all four Containerfiles, which is what Renovate produces for one tag. - **Python 3.15 compatibility of the stdlib-only controllers.** The imports in `ci/images/authentik-gate-sync/controller.py` and `ci/images/netbird-service-sync/controller.py` are hashlib, json, logging, os, sys, time, urllib.* and ssl. None looks removed, but I did not check the 3.15 changelog (Renovate skipped release notes). The authentik image runs its unittest suite as a build stage (`Containerfile:8-11`). The netbird image runs nothing at build time, so its first 3.15 run happens in the cluster. - **heating-can on 3.15.** The build self-test (`ci/images/heating-can/Containerfile:101-108`) only runs `open3e --help` and `E3onCANcollect.py --help`. Whether open3e and E3onCAN install with 3.15 wheels, and whether they behave on the bus, is not something my tools can check. - **Trivy flags.** `.woodpecker/security-scan.yml:23,31,51` use `--timeout`, `--scanners`, `--skip-db-update` and `--download-db-only`. The trivy `latest` digest moves with this PR, and I could not read its release notes to confirm those flags are unchanged. - **Branch lookup anomaly.** `get_by_branches` for `renovate/ci-minor-patch` returned closed PR #1126 (merged 2026-10-05) with the same head SHA `f8b98907`. Master's `authentik-gate-sync/Containerfile` (blob `8353a7b1`) and `heating-can/Containerfile` (blob `bc53495e`) still show 3.14 and match this diff's base lines. I am treating #1126's SHA as a stale record for the reused branch name, not as a merged change. ## 🟡 Suggestions - `ansible/roles/heating-can/defaults/main.yml:67` sets `heating_can_image: gitea.renner.uno/gitea_admin/heating-can:latest`. `ansible/roles/heating-can/tasks/main.yml:154-166` runs `docker compose pull` and `up -d` on every converge. Merging touches `ci/images/heating-can/**`, which `.woodpecker/build-ci-images.yml` builds on master push, so `:latest` is republished on Python 3.15. The next converge then recreates the containers that read the heat-pump bus, and the only pre-deploy check is the `--help` self-test. Before that converge, run the new image once by hand against the bus, or pin `heating_can_image` to the pre-bump dated tag until that run is done. ## Tests No code changed, so no new tests are expected. The authentik unittest stage (`ci/images/authentik-gate-sync/Containerfile:8-11`) runs under 3.15 at build time and gates that image. The heating-can self-test proves only that the binaries start, which is the gap raised in the suggestion above. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 9e62fadcb1 into master

2026-10-19 05:17:05 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1345