chore(deps): Update favonia/cloudflare-ddns Docker tag to v1.18.0 #123

2026-11-07T08:17:10Z

renovate-bot commented

2026-11-07 08:17:10 +00:00

This PR contains the following updates:

Package	Update	Change
favonia/cloudflare-ddns	minor	`1.17.1` → `1.18.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

favonia/cloudflare-ddns

`v1.18.0`

Compare Source

Update promptly to this version (1.18.0) for HTTPS security fixes. This release also fixes failure reporting for one-shot work and shutdown cleanup, along with one-shot WAF list deletion.

Security

Compromised eMudhra certificate authority keys allow attackers to forge HTTPS certificates for websites they do not control. An attacker who can intercept or redirect the updater’s HTTPS connections could use these certificates to impersonate an IP detection service or the Cloudflare API. The default configuration is affected.

Docker images are built with Go 1.27.3, which rejects certificate chains containing the compromised keys (CVE-2026-111943 and the Go security announcement). The images also include the security fixes in Go 1.27.2.

To upgrade, pull the updated image and recreate your container. If you build from source, rebuild with Go 1.27.3 or a later patched version.

Improvements and Fixes

Exit status reports failed work. Failed or interrupted one-shot work (UPDATE_CRON=@once) and failed shutdown cleanup (DELETE_ON_STOP=true) now return 1 instead of 0. Update failures during a scheduled run do not affect its exit status on normal shutdown. See Exit Status for details. (#1290)
One-shot cleanup can now delete WAF lists. Previously, runs with UPDATE_CRON=@once and DELETE_ON_STOP=true cleared managed WAF items but did not attempt to delete the lists themselves. (#1289, #1290)

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "after 3am and before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [favonia/cloudflare-ddns](https://github.com/favonia/cloudflare-ddns) | minor | `1.17.1` → `1.18.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/91) for more information. --- ### Release Notes <details> <summary>favonia/cloudflare-ddns</summary> ### [`v1.18.0`](https://github.com/favonia/cloudflare-ddns/blob/HEAD/CHANGELOG.markdown#1180-2026-10-23) [Compare Source](https://github.com/favonia/cloudflare-ddns/compare/v1.17.1...v1.18.0) **Update promptly to this version (1.18.0) for HTTPS security fixes.** This release also fixes failure reporting for one-shot work and shutdown cleanup, along with one-shot WAF list deletion. #### Security [Compromised eMudhra certificate authority keys](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) allow attackers to forge HTTPS certificates for websites they do not control. An attacker who can intercept or redirect the updater’s HTTPS connections could use these certificates to impersonate an IP detection service or the Cloudflare API. The default configuration is affected. Docker images are built with Go 1.27.3, which rejects certificate chains containing the compromised keys ([CVE-2026-111943 and the Go security announcement](https://groups.google.com/g/golang-announce/c/66pojueaQek)). The images also include the [security fixes in Go 1.27.2](https://go.dev/doc/devel/release#go1.27.0). To upgrade, pull the updated image and recreate your container. If you build from source, rebuild with Go 1.27.3 or a later patched version. #### Improvements and Fixes - **Exit status reports failed work.** Failed or interrupted one-shot work (`UPDATE_CRON=@once`) and failed shutdown cleanup (`DELETE_ON_STOP=true`) now return 1 instead of 0. Update failures during a scheduled run do not affect its exit status on normal shutdown. See [Exit Status](README.markdown#exit-status) for details. ([#1290](https://github.com/favonia/cloudflare-ddns/pull/1290)) - **One-shot cleanup can now delete WAF lists.** Previously, runs with `UPDATE_CRON=@once` and `DELETE_ON_STOP=true` cleared managed WAF items but did not attempt to delete the lists themselves. ([#1289](https://github.com/favonia/cloudflare-ddns/pull/1289), [#1290](https://github.com/favonia/cloudflare-ddns/pull/1290)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "after 3am and before 6am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the dependencies automated-update labels 2026-11-07 08:17:10 +00:00

renovate-bot added 1 commit 2026-11-07 08:17:10 +00:00

chore(deps): Update favonia/cloudflare-ddns Docker tag to v1.18.0

gate / gate (pull_request) Successful in 2m57s

Details

gate / conformance (pull_request) Has been skipped

Details

ae772e050d

renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-11-07 08:17:10 +00:00

renovate-bot merged commit 6cd3bd29a9 into main

2026-11-07 08:37:59 +00:00

renovate-bot deleted branch renovate/favonia-cloudflare-ddns-1.x