webgrip/homelab-cluster
5
0
Fork 0
Code Issues 2 Pull requests 18 Projects Releases Packages Wiki Activity Actions

[PR #176] [CLOSED] chore(review): add Renovate dependency review for valkey 9.0.4 → 9.1.0 (PR #174) #217

New issue
Closed
opened 2026-06-08 08:30:44 +00:00 by ryangr0 · 0 comments
ryangr0 commented 2026-06-08 08:30:44 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/176
Author: @Copilot
Created: 5/23/2026
Status: ❌ Closed

Base: main ← Head: copilot/review-174-dependency-update

📝 Commits (3)

📄 Description

Automated risk assessment for PR #174, which bumps docker.io/valkey/valkey from 9.0.4 to 9.1.0 as the SearXNG cache sidecar.

Review output

  • Verdict: Yellow Caution — merge after checks
  • Security: Patches 3 CVEs (CVE-2026-23479, CVE-2026-25243, CVE-2026-23631) — two use-after-free and one invalid memory access, all authenticated-only vectors; cluster-internal exposure limits blast radius
  • Breaking changes: None; upstream upgrade urgency is LOW
  • Rollback risk: Low — persistence is disabled (--save "", --appendonly no); pod restart is safe
  • Digest pinning: Verified; new digest matches 9.1.0 tag

Delivery

Written to .copilot-review/result.md for relay workflow pickup and posting as a comment on PR #174.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/176 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 5/23/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `copilot/review-174-dependency-update` --- ### 📝 Commits (3) - [`a835cf0`](https://github.com/webgrip/homelab-cluster/commit/a835cf008681836907d79aa00096a02654d8bcf2) Initial plan - [`37898ec`](https://github.com/webgrip/homelab-cluster/commit/37898ec423d0920d5daa4c3af88ccaf93b053904) copilot-review: PR #174 - [`f4b4b98`](https://github.com/webgrip/homelab-cluster/commit/f4b4b98ff7bbe8755ec98fdc2ed27e83eced8e91) chore: remove copilot review artifact ### 📄 Description Automated risk assessment for PR #174, which bumps `docker.io/valkey/valkey` from `9.0.4` to `9.1.0` as the SearXNG cache sidecar. ## Review output - **Verdict:** Yellow Caution — merge after checks - **Security:** Patches 3 CVEs (CVE-2026-23479, CVE-2026-25243, CVE-2026-23631) — two use-after-free and one invalid memory access, all authenticated-only vectors; cluster-internal exposure limits blast radius - **Breaking changes:** None; upstream upgrade urgency is LOW - **Rollback risk:** Low — persistence is disabled (`--save ""`, `--appendonly no`); pod restart is safe - **Digest pinning:** Verified; new digest matches `9.1.0` tag ## Delivery Written to `.copilot-review/result.md` for relay workflow pickup and posting as a comment on PR #174. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
ryangr0 2026-06-08 08:30:44 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.34.x
renovate/patch-mise-tools
renovate/harbor.webgrip.dev-dockerhub-amazon-aws-cli-2.36.x
renovate/docker.io-amazon-aws-cli-2.36.x
fix/litellm-ingress-ploeg
renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.x
renovate/harbor.webgrip.dev-dockerhub-python-3.14-alpine
renovate/docker.io-python-3.14-slim
renovate/harbor.webgrip.dev-dockerhub-library-docker-29.7.x
feat/ploeg-bench-team
fix/runner-mem-request-node-pressure
fix/runner-mem-grype-oom
fix/harbor-ci-robot-tag-delete
renovate/platform-patch-flux-oci-helm-charts-(platform)
renovate/docker.io-renovate-renovate-43.x
renovate/ghcr.io-siderolabs-kubelet-1.36.x
renovate/harbor.webgrip.dev-dockerhub-dxflrs-garage-2.x
renovate/docker.io-alpine-3.x
renovate/patch-flux-controllers
renovate/harbor.webgrip.dev-dockerhub-invoiceninja-invoiceninja-5.13.x
feat/retire-ghcr-policies
feat/renovate-enable-gomod
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/homelab-cluster#217
No description provided.