chore(deps): update all non-major dependencies

2026-10-05 02:01:26 +00:00
parent f930971102
commit 68c0978660
17 changed files with 19 additions and 19 deletions
@@ -48,7 +48,7 @@ spec:
        # cert when doing server-side OIDC token exchange. Bundle both
        # roots into one PEM since NODE_EXTRA_CA_CERTS accepts one file.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.10.1
+          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
          command:
            - sh
            - -c
@@ -23,7 +23,7 @@ spec:
      enableServiceLinks: false
      containers:
        - name: evcc
-          image: evcc/evcc:0.310.1
+          image: evcc/evcc:0.316.2@sha256:070c8a8912c5107e8424cef60bf8c3d3cac0eb32aa28d1b021d226545f0aac7b
          # evcc auto-discovers /etc/evcc.yaml on its default search path;
          # the file is delivered (with the MQTT password) via the
          # sops-encrypted evcc-config Secret mounted below.
@@ -66,7 +66,7 @@ spec:
        # The library PVC is populated by the seed phase before this
        # Deployment reconciles, so no rsync init is needed here.
        - name: fetch-le-staging-roots
-          image: curlimages/curl:8.10.1
+          image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
          command:
            - sh
            - -c
@@ -48,7 +48,7 @@ spec:
            # this sentinel: the entrypoint copies AccountsSettings.json
            # into ephemeral /config-internal rather than symlinking it.
            - name: seed-config
-              image: busybox:1.37.0
+              image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
              command: ["/bin/sh", "-eu", "-c"]
              args:
                - |
@@ -94,7 +94,7 @@ spec:
            - name: libation
              # Pinned by digest: Spegel caches mutable tag resolutions, so
              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
-              image: docker.io/rmcrackan/libation:14.2.1@sha256:6f9d8ba19dc3803dd6ba295ab5a7abfb6ff3bc06286eebf4ecd8ccbe43245888
+              image: docker.io/rmcrackan/libation:14.2.2@sha256:fe188ac3c4ce63cc305971c76e648748341427e16bcf884011da8a384fd3908c
              # The entrypoint stages config into ephemeral /config-internal
              # by copy (only the DB is symlinked to the PVC), so Audible
              # tokens refreshed during a run are lost at container exit.
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: "91.7.0"
+      version: "91.9.0"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -36,7 +36,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: nginx
-          image: nginxinc/nginx-unprivileged:1.27-alpine
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:26b0bf6fbf07297983cb341998d79c831508787de26627dd2a112321b9c3a4af
          ports:
            - name: http
              containerPort: 8080
@@ -67,7 +67,7 @@ spec:
          # alpine/kubectl is the maintained replacement. Pin the tag
          # to the cluster's server version so kubectl is in lock-step
          # (mismatched skew can break exec streaming).
-          image: docker.io/alpine/kubectl:1.35.2
+          image: docker.io/alpine/kubectl:1.37.1@sha256:b57b3bd3cd9f4f02dd444281857126aa78efa4b7b7e6ec57579dd927bf146fc3
          env:
            - name: DATASET_TLV
              valueFrom:
@@ -22,7 +22,7 @@ spec:
          type: RuntimeDefault
      initContainers:
        - name: prepare-dirs
-          image: alpine:3.21
+          image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
          command:
            - sh
            - -c
@@ -287,7 +287,7 @@ spec:
              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
        # anchor: bridge-tls-proxy
        - name: bridge-tls-proxy
-          image: alpine/socat:1.8.0.3
+          image: alpine/socat:1.8.1.3@sha256:82ad20f6f6e29b91ff33b6662d24063522b1378f08fd8569cd3ab412cac13f50
          args:
            - "-d"
            - "TCP-LISTEN:11143,fork,reuseaddr,bind=127.0.0.1"
@@ -50,7 +50,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: syncthing
-          image: syncthing/syncthing:2.0.16
+          image: syncthing/syncthing:2.1.5@sha256:397aa00b92b48d65540ea3ae3cbf271b87bdccbe07a0b7bd7d2debc3a7b29138
          env:
            # UI bind: any-interface so the ClusterIP Service can reach
            # it. Network exposure is gated by the absence of an Ingress
@@ -59,7 +59,7 @@ spec:
            - name: renovate
              # Pinned by tag and digest. Renovate updates itself through
              # homelab's renovate.json, like any other image here.
-              image: docker.io/renovate/renovate:44.115.10@sha256:e262ed52b23dd8c545c80faf5b1ad5c95a07b3f198888de8d7b8928f45c307c7
+              image: docker.io/renovate/renovate:44.133.0@sha256:05c512c35c764ef6a179e69c3b30567eca254d67f13a0143479fe3c84852c67a
              env:
                - name: RENOVATE_CONFIG_FILE
                  value: /config/config.json
@@ -25,7 +25,7 @@ spec:
        fsGroup: 33
      containers:
        - name: wordpress
-          image: wordpress:7.0.4-php8.3-apache
+          image: wordpress:7.1.2-php8.3-apache@sha256:4abf7a450ee477dde967584f8174d7e03221d224c4971a0c38d84e7254426e64
          ports:
            - name: http
              containerPort: 80
@@ -65,7 +65,7 @@ spec:
          # first build of that day — imagePullPolicy: Always does not help,
          # because the tag itself resolves stale. Update this when the image
          # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
+          image: gitea.renner.uno/gitea_admin/bird@sha256:043733b9c75d84c76e7dd1551fb1a3375952ce94500485832d2f9369ed9e2585
          command: ["/bin/sh", "-c"]
          args:
            - |
@@ -91,7 +91,7 @@ spec:
              mountPath: /etc/bird
      containers:
        - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
+          image: gitea.renner.uno/gitea_admin/bird@sha256:043733b9c75d84c76e7dd1551fb1a3375952ce94500485832d2f9369ed9e2585
          resources:
            requests:
              cpu: "50m"
@@ -41,7 +41,7 @@ spec:
      webhook:
        image:
          repository: ghcr.io/kashalls/external-dns-unifi-webhook
-          tag: v0.4.1
+          tag: v0.9.0@sha256:22f4106f44a0b9ac3c97cf29bbfef93026c1164492152dc797a1d6dc86ddfbb5
        resources:
          requests:
            cpu: 10m
@@ -63,7 +63,7 @@ spec:
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
-          image: intel/intel-gpu-plugin:0.36.0
+          image: intel/intel-gpu-plugin:0.37.1@sha256:004641b2547d58f1eadce58473fa160ad71377de1eb588cf1f82832387bf3e33
          imagePullPolicy: IfNotPresent
          args:
            # Slots the single iGPU is handed out as, letting that many
@@ -72,7 +72,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: restore-test
-              image: alpine/k8s:1.35.2
+              image: alpine/k8s:1.37.1@sha256:712dc5385d1c1a3f83b747fa9e40f64d433a97f72ff42f9755ff7dd1f62846e4
              command: ["bash", "/script/restore-test.sh"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -8,7 +8,7 @@
 # lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
 # OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
 # binary can take over the external-API rotators — Cloudflare, Proxmox.)
-FROM rust:1.91-alpine AS build
+FROM rust:1.99-alpine@sha256:0cce0a5e0e8ba67b455257a3a02a1d99005f382748789d6464460028810f1627 AS build

 # musl-dev provides the C runtime bits the linker needs for a fully static
 # binary; nothing from it ends up in the final image.