Skip to content

ircd: update ghcr.io/ergochat/ergo Docker tag to v2.19.0#425

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/ghcr.io-ergochat-ergo-2.x
Open

ircd: update ghcr.io/ergochat/ergo Docker tag to v2.19.0#425
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/ghcr.io-ergochat-ergo-2.x

Conversation

@renovate

@renovate renovate Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
ghcr.io/ergochat/ergo Kustomization minor v2.18.0v2.19.0

Release Notes

ergochat/ergo (ghcr.io/ergochat/ergo)

v2.19.0

Compare Source

We're pleased to be publishing v2.19.0, a new stable release. This release contains IRCv3 specification-related updates, bug fixes, and minor enhancements.

This release includes changes to the config file format, one of which is not backwards-compatible (see below to determine whether you are affected). It includes no changes to the database file format.

Many thanks to @​andymandias, dzwdz, @​emersion, @​englut, @​Jokler, @​jwheare, @​KlaasT, @​luxaritas, @​SAY-5, @​skizzerz, @​tacerus, @​ValwareIRC, and @​whitequark for helpful discussions, contributing patches, reporting issues, and helping test.

Compatibility breaks
  • The extjwt configuration block now takes algorithm (hmac, rsa, or eddsa) and either key or key-file to configure the signing key (see default.yaml for examples). If you are using extjwt, the suggested upgrade path is to add the new keys before upgrading (duplicating the legacy keys secret and/or rsa-private-key-file), upgrade Ergo, then once the new version is confirmed stable, delete the legacy keys. (#​2385)
  • JWTs accepted via the IRCV3BEARER SASL mechanism now require an expiration time. (#​2385)
  • Incoming batch IDs for draft/multiline are now validated for conformance with the specification's grammar, i.e. they MUST contain only ASCII alphanumerics and hyphens (#​2391, thanks @​ValwareIRC!)
Security
  • Fixed channel metadata being readable by non-joined users (including for invite-only or otherwise private channels) (#​2382)
  • Fixed registered secret channels appearing in unprivileged NS INFO output (#​2405, thanks dzwdz!)
Config changes
  • The extjwt configuration block now takes algorithm (hmac, rsa, or eddsa) and either key or key-file to configure the signing key (see default.yaml for examples) (#​2385)
  • Added an optional validate-aud to jwt-auth; if present, JWTs submitted via SASL IRCV3BEARER are required to contain one of the whitelisted aud claims (#​2385)
  • Added authtoken block to configure the new draft/authtoken mechanism for external service integration (#​2385)
  • Added socket to auth-script and ip-check-script, allowing the script protocol to run over Unix domain socket instead of subprocess execution (#​2280)
Added
  • Added support for draft/authtoken, a proposed IRCv3 extension allowing secure integration with external services (#​2385, thanks @​skizzerz, @​whitequark!)
  • Added support for draft/whoami, a proposed IRCv3 extension allowing clients to track their message source ("NUH") (#​2417)
  • HTTP cookies are harvested from the initial websocket handshake; if a websocket client sends SASL EXTERNAL, they can be passed to an auth-script for validation (future versions of Ergo may implement some form of native HTTP cookie authentication) (#​2185, thanks @​emersion!)
  • Added new API endpoints: /v1/whois (analogue of the WHOIS command to get information about an active nickname), /v1/ns/saget (retrieves user account settings), and /v1/ns/saset (modifies user account settings) (#​2387, #​2421, thanks @​KlaasT!)
  • Added a new ChanServ setting store-events to optionally suppress history storage of events like JOIN and QUIT (#​2424, thanks @​luxaritas!)
Fixed
  • Fixed a race condition where an always-on client's channel join might not be persisted (#​2398)
  • Fixed the bot tag being omitted from replayed DMs and echo messages (#​2393, #​2395, thanks @​andymandias!)
  • Fixed client-only tags attached to RELAYMSG not being stored in history (#​2407, thanks @​Jokler!)
  • Fixed handling of labeled QUIT messages (#​2402, thanks @​progval!)
  • Fixed handling of oversized CAP REQ messages (#​2411, #​2414, thanks @​SAY-5!)
  • Fixed a case where fakelag might be imposed unnecessarily after a large multiline message (#​2409)
  • Fixed handling of invalid API bearer token configurations (#​2380)
Changed
  • Updated to draft/metadata-3; the updates are largely but not completely compatible with draft/metadata-2. To simplify the upgrade process, draft/metadata-2 is still advertised, but with the draft/metadata-3 behavior. (#​2416, thanks @​skizzerz!)
  • Ergo now adds the draft/chathistory-end to chathistory batches to indicate the end of pagination (either the tag or an empty batch indicates the end of pagination; future versions of Ergo may return batches shorter than the pagination window that do not indicate the end of pagination) (#​2379, thanks @​emersion!)
  • Updated to the ratified cap no-implicit-names (#​2390, thanks @​englut!)
Internal
  • Release builds use Go 1.26.5
  • Updated the recommended AppArmor profile in distrib/ (#​2401, thanks @​tacerus!)
  • Established a security policy, including provisions for private vulnerability reporting on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

Copy link
Copy Markdown

Infro diff for c5bd1df

argocd.hashbang.sh > cloudnative-pg (0 files changed)

Details
time="2026-07-21T07:31:07Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T07:31:17Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apiextensions.k8s.io/CustomResourceDefinition /clusters.postgresql.cnpg.io ======
--- /tmp/argocd-diff1897124649/clusters.postgresql.cnpg.io-live.yaml
+++ /tmp/argocd-diff1897124649/clusters.postgresql.cnpg.io
@@ -5784,7 +5784,6 @@
                       procMount denotes the type of proc mount to use for the containers.
                       The default value is Default which uses the container runtime defaults for
                       readonly paths and masked paths.
-                      This requires the ProcMountType feature flag to be enabled.
                       Note that this field cannot be set when spec.os.name is windows.
                     type: string
                   readOnlyRootFilesystem:

===== apiextensions.k8s.io/CustomResourceDefinition /poolers.postgresql.cnpg.io ======
--- /tmp/argocd-diff2462456407/poolers.postgresql.cnpg.io-live.yaml
+++ /tmp/argocd-diff2462456407/poolers.postgresql.cnpg.io
@@ -2934,7 +2934,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -4505,7 +4504,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -4989,7 +4987,6 @@
                           When set to false, a new userns is created for the pod. Setting false is useful for
                           mitigating container breakout vulnerabilities even allowing users to run their
                           containers as root without actually having root privileges on the host.
-                          This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.
                         type: boolean
                       hostname:
                         description: |-
@@ -6159,7 +6156,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -6728,6 +6724,14 @@
 
                             It adds a name to it that uniquely identifies the ResourceClaim inside the Pod.
                             Containers that need access to the ResourceClaim reference it with this name.
+
+                            When the DRAWorkloadResourceClaims feature gate is enabled and this Pod
+                            belongs to a PodGroup, a PodResourceClaim is matched to a
+                            PodGroupResourceClaim if all of their fields are equal (Name,
+                            ResourceClaimName, and ResourceClaimTemplateName). A matched claim references
+                            a single ResourceClaim shared across all Pods in the PodGroup, reserved for
+                            the PodGroup in ResourceClaimStatus.ReservedFor rather than for individual
+                            Pods.
                           properties:
                             name:
                               description: |-
@@ -6753,6 +6757,16 @@
                                 generated component, will be used to form a unique name for the
                                 ResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.
 
+                                When the DRAWorkloadResourceClaims feature gate is enabled and the pod
+                                belongs to a PodGroup that defines a PodGroupResourceClaim with the same
+                                Name and ResourceClaimTemplateName, this PodResourceClaim resolves to the
+                                ResourceClaim generated for the PodGroup. All pods in the group that
+                                define an equivalent PodResourceClaim matching the
+                                PodGroupResourceClaim's Name and ResourceClaimTemplateName share the same
+                                generated ResourceClaim. ResourceClaims generated for a PodGroup are
+                                owned by the PodGroup and their lifecycles are tied to the PodGroup
+                                instead of any individual pod.
+
                                 This field is immutable and no changes will be made to the
                                 corresponding ResourceClaim by the control plane after creating the
                                 ResourceClaim.
@@ -6878,6 +6892,28 @@
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
+                      schedulingGroup:
+                        description: |-
+                          SchedulingGroup provides a reference to the immediate scheduling runtime
+                          grouping object that this Pod belongs to.
+                          This field is used by the scheduler to identify the group and apply the
+                          correct group scheduling policies. The association with a group also
+                          impacts other lifecycle aspects of a Pod that are relevant in a wider context
+                          of scheduling like preemption, resource attachment, etc. If not specified,
+                          the Pod is treated as a single unit in all of these aspects.
+                          The group object referenced by this field may not exist at the time the
+                          Pod is created.
+                          This field is immutable, but a group object with the same name may be
+                          recreated with different policies. Doing this during pod scheduling
+                          may result in the placement not conforming to the expected policies.
+                        properties:
+                          podGroupName:
+                            description: |-
+                              PodGroupName specifies the name of the standalone PodGroup object
+                              that represents the runtime instance of this group.
+                              Must be a DNS subdomain.
+                            type: string
+                        type: object
                       securityContext:
                         description: |-
                           SecurityContext holds pod-level security attributes and common container settings.
@@ -8306,7 +8342,7 @@
                                 A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
                                 The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                 The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
-                                The volume will be mounted read-only (ro) and non-executable files (noexec).
+                                The volume will be mounted read-only (ro).
                                 Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                                 The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                               properties:
@@ -8478,8 +8514,7 @@
                               description: |-
                                 portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
                                 Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
-                                are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
-                                is on.
+                                are redirected to the pxd.portworx.com CSI driver.
                               properties:
                                 fsType:
                                   description: |-
@@ -9302,42 +9337,6 @@
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
-                      workloadRef:
-                        description: |-
-                          WorkloadRef provides a reference to the Workload object that this Pod belongs to.
-                          This field is used by the scheduler to identify the PodGroup and apply the
-                          correct group scheduling policies. The Workload object referenced
-                          by this field may not exist at the time the Pod is created.
-                          This field is immutable, but a Workload object with the same name
-                          may be recreated with different policies. Doing this during pod scheduling
-                          may result in the placement not conforming to the expected policies.
-                        properties:
-                          name:
-                            description: |-
-                              Name defines the name of the Workload object this Pod belongs to.
-                              Workload must be in the same namespace as the Pod.
-                              If it doesn't match any existing Workload, the Pod will remain unschedulable
-                              until a Workload object is created and observed by the kube-scheduler.
-                              It must be a DNS subdomain.
-                            type: string
-                          podGroup:
-                            description: |-
-                              PodGroup is the name of the PodGroup within the Workload that this Pod
-                              belongs to. If it doesn't match any existing PodGroup within the Workload,
-                              the Pod will remain unschedulable until the Workload object is recreated
-                              and observed by the kube-scheduler. It must be a DNS label.
-                            type: string
-                          podGroupReplicaKey:
-                            description: |-
-                              PodGroupReplicaKey specifies the replica key of the PodGroup to which this
-                              Pod belongs. It is used to distinguish pods belonging to different replicas
-                              of the same pod group. The pod group policy is applied separately to each replica.
-                              When set, it must be a DNS label.
-                            type: string
-                        required:
-                        - name
-                        - podGroup
-                        type: object
                     required:
                     - containers
                     type: object

===== coordination.k8s.io/Lease /db9c8771.cnpg.io ======
--- /tmp/argocd-diff3148718210/db9c8771.cnpg.io-live.yaml
+++ /tmp/argocd-diff3148718210/db9c8771.cnpg.io
@@ -0,0 +1,11 @@
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  annotations:
+    argocd.argoproj.io/tracking-id: cloudnative-pg:coordination.k8s.io/Lease:cloudnative-pg/db9c8771.cnpg.io
+  labels:
+    app.kubernetes.io/component: manager
+    app.kubernetes.io/instance: cloudnative-pg
+    app.kubernetes.io/name: cloudnative-pg
+  name: db9c8771.cnpg.io
+spec: {}

argocd.hashbang.sh > external-dns (0 files changed)

Details
time="2026-07-21T07:31:19Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T07:31:23Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment external-dns/external-dns ======
--- /tmp/argocd-diff596719463/external-dns-live.yaml
+++ /tmp/argocd-diff596719463/external-dns
@@ -173,11 +173,6 @@
         - --provider=aws
         - --txt-owner-id=digitalocean-hashbang
         - --txt-prefix=_owner.
-        - --source=crd
-        - --domain-filter=hashbang.sh
-        - --managed-record-types=A
-        - --managed-record-types=CNAME
-        - --managed-record-types=TXT
         env:
         - name: AWS_REGION
           value: us-west-2

argocd.hashbang.sh > ircd (0 files changed)

Details
time="2026-07-21T07:31:29Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T07:31:34Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment ircd/irc-deployment ======
--- /tmp/argocd-diff1817640226/irc-deployment-live.yaml
+++ /tmp/argocd-diff1817640226/irc-deployment
@@ -29,7 +29,7 @@
         app: irc
     spec:
       containers:
-      - image: ghcr.io/ergochat/ergo:v2.18.0@sha256:8e2eae935b59f5bd6c0cb567c94d8ab4f825e4c62c532e94ef09a7bbfcef30e6
+      - image: ghcr.io/ergochat/ergo:v2.19.0@sha256:98975f36281cc4d65ed00bfd2764a4e6794ed39c354de385561f74d0c7ad12ef
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -77,7 +77,7 @@
           echo "Exiting.";
         command:
         - /bin/sh
-        image: ghcr.io/ergochat/ergo:v2.18.0@sha256:8e2eae935b59f5bd6c0cb567c94d8ab4f825e4c62c532e94ef09a7bbfcef30e6
+        image: ghcr.io/ergochat/ergo:v2.19.0@sha256:98975f36281cc4d65ed00bfd2764a4e6794ed39c354de385561f74d0c7ad12ef
         imagePullPolicy: IfNotPresent
         name: config-reloader
         resources: {}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants