chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2

Merge pull request 'chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4' (#163 ) from renovate/ghcr.io-renovatebot-renovate-44.x into main
Reviewed-on: #163 Reviewed-by: Keith Jackson <[email protected]>
2026-11-13 08:16:36 +00:00 · 2026-11-11 17:23:44 +00:00 · 2026-11-11 08:16:19 +00:00 · 2026-11-10 14:16:51 +00:00 · 2026-11-10 08:23:09 +00:00 · 2026-11-10 08:22:11 +00:00
6 changed files with 6 additions and 6 deletions
@@ -151,7 +151,7 @@ jobs:
    # actions/checkout: Renovate clones the repo itself from RENOVATE_ENDPOINT, and as uid 12021
    # checkout could not `git init` the root-owned workspace volume anyway.
    container:
-      image: ghcr.io/renovatebot/renovate:44.167.0
+      image: ghcr.io/renovatebot/renovate:44.227.4
    # Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
    # well under a runner's patience. Without a timeout a wedged run holds the `renovate`
    # concurrency group and silently blocks every subsequent scheduled run.
@@ -78,7 +78,7 @@ spec:
    spec:
      containers:
      - name: semaphore
-        image: semaphoreui/semaphore:v2.19.17
+        image: semaphoreui/semaphore:v2.20.23
        ports:
        - containerPort: 3000
        env:
@@ -22,7 +22,7 @@
 name: semaphore
 kind: container
 source:
-  image: semaphoreui/semaphore:v2.19.17   # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: semaphoreui/semaphore:v2.20.23   # pinned recent stable tag (R-UPD-01); update.range governs advancement
 env:
  # --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
  #     sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,
@@ -18,7 +18,7 @@
 # digest. For a LOCAL build on a local toolbox, override it:
 #   infra/devcontainer/dev.sh build && AGENT_BASE_IMAGE=home-k3s-dev:local infra/agent/build-image.sh
 # renovate-digest: image=gitea.home.keithjackson.dev/home-network/toolbox tag=main
-AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:d435fabd6fc43bf5bb4de0c1ea8c4b19d8cea5c858679bd1675ccbed471b528a
+AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:83a3501efe34fa0b039e3f0d360738686a0f59109866c49779768f5d5ed0ef81

 # Node.js — the runtime for the Claude Code CLI, installed from the Fedora base's module
 # stream. A major version, not a patch: the CLI supports the active LTS line and the
@@ -24,7 +24,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: ">=88.0.0 <89.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
+      version: ">=93.1.1 <94.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -76,7 +76,7 @@ spec:
          # The image's ENTRYPOINT is `trivy`, overridden below. /bin/cp (busybox) and
          # /etc/ssl/certs/ca-certificates.crt confirmed present by listing the layers via the
          # registry API (no image run).
-          image: ghcr.io/aquasecurity/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
+          image: ghcr.io/aquasecurity/trivy:0.76.2@sha256:8f6bb947dbc528902e11f2f5be52f7b519f6a39d5d148f41166f2040499768fb
          imagePullPolicy: IfNotPresent
          command:
            - /bin/cp
Author	SHA1	Message	Date
renovate-bot	120913b04e	chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2 renovate/stability-days Updates have not met minimum release age requirement Details gate / gate (pull_request) Successful in 48s Details gate / conformance (pull_request) Skipped Details	2026-11-13 08:16:36 +00:00
jakman85	b4ea0fd643	Merge pull request 'chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4' (#163 ) from renovate/ghcr.io-renovatebot-renovate-44.x into main gate / gate (push) Successful in 1m12s Details gate / conformance (push) Skipped Details Reviewed-on: #163 Reviewed-by: Keith Jackson <[email protected]>	2026-11-11 17:23:44 +00:00
renovate-bot	7c2a6155a4	chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v44.227.4 gate / gate (pull_request) Successful in 1m7s Details gate / conformance (pull_request) Skipped Details	2026-11-11 08:16:19 +00:00
jakman85	f38743da2c	Merge pull request 'chore(deps): Update Helm release kube-prometheus-stack to v93' (#164 ) from renovate/kube-prometheus-stack-93.x into main gate / gate (push) Successful in 53s Details gate / conformance (push) Skipped Details Reviewed-on: #164	2026-11-10 14:16:51 +00:00
renovate-bot	8c440c15ba	Merge pull request 'chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23' (#167 ) from renovate/semaphoreui-semaphore-2.x into main gate / gate (push) Failing after 1m21s Details gate / conformance (push) Skipped Details	2026-11-10 08:23:09 +00:00
renovate-bot	17e67fdff7	chore(deps): Update Helm release kube-prometheus-stack to v93 gate / gate (pull_request) Successful in 1m21s Details gate / conformance (pull_request) Skipped Details	2026-11-10 08:22:11 +00:00
renovate-bot	d1c99cd116	chore(deps): Update semaphoreui/semaphore Docker tag to v2.20.23 gate / gate (pull_request) Successful in 57s Details gate / conformance (pull_request) Skipped Details	2026-11-10 08:22:01 +00:00
renovate-bot	1c3507d98a	Merge pull request 'chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501' (#161 ) from renovate/gitea.home.keithjackson.dev-home-network-toolbox-main into main gate / gate (push) Failing after 57s Details gate / conformance (push) Skipped Details images / images (push) Failing after 42s Details	2026-11-10 08:17:38 +00:00
renovate-bot	c00d06f103	chore(deps): Update gitea.home.keithjackson.dev/home-network/toolbox:main Docker digest to 83a3501 gate / gate (pull_request) Successful in 1m1s Details gate / conformance (pull_request) Skipped Details images / images (pull_request) Successful in 4s Details	2026-11-10 08:16:32 +00:00
jakman85	190cd6b81a	Merge pull request 'feat(vuln): automated CVE visibility for production (R-VULN-*, ADR-0027)' (#165 ) from feat/vuln-visibility into main gate / gate (push) Successful in 58s Details gate / conformance (push) Skipped Details Reviewed-on: #165 Reviewed-by: Keith Jackson <[email protected]>	2026-11-09 22:41:50 +00:00