fix(container): update image ghcr.io/home-operations/tautulli ( 2.17.0 ➔ 2.17.1 )

[waifuz-bot]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/tautulli (source)	patch	2.17.0 → 2.17.1

---

Release Notes

Tautulli/Tautulli (ghcr.io/home-operations/tautulli)

v2.17.1

Compare Source

• Notifications:
  • Fix: Tautulli Remote App notifications failing to send. (#​2669)
  • New: Added extra type and preroll to notification parameters.
  • New: Added Simkl URL to notification parameters.
• Newsletters:
  • Fix: Remote code execution via newsletter custom template directory. (CVE-2026-41065) (Thanks @​remindsec)
• Exporter:
  • Fix: Export failed when logo / square art keys were included. (#​2685)
• UI:
  • Fix: Error when browsing for folder paths. (#​2673)
  • New: Added AV1 media flag image. (#​2676) (Thanks @​little0831)
  • New: Added opus media flag image.
• Other:
  • Fix: Clean empty directories after updating using git. (#​2667)
  • Fix: Tautulli failing to reconnect to Plex Media Server until restarted after a connection loss at startup. (#​2640)
  • Fix: Path treversal in cache deletion API. (CVE-2026-40605) (Thanks @​JakePeralta7)
  • Fix: Websocket not exiting and reconnecting cleanly after changing Plex servers.
  • Fix: Sanitize JS log errors to prevent XSS. (CVE-2026-43984) (Thanks @​larlarua)
  • Fix: Do not store image hash for external images. (CVE-2026-43986) (Thanks @​larlarua)
  • New: Update Windows and MacOS packages to Python 3.13.
  • New: Update Snap package to core24.
  • New: Using mounted folders for custom newsletter templates and scripts requires manually enabling allow_mounted_folders = 1 in the config file.
  • New: Added anti-CSRF tokens and enforce POST methods to state change endpoints. (CVE-2026-43985) (Thanks @​larlarua)
  • New: Hash Tautulli cookie name. All existing login sessions will be invalidated after the update.
  • New: Require X-Api-Key header for login through the /auth/signin endpoint.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[waifuz-bot]

--- kubernetes/apps/entertainment/tautulli/app Kustomization: entertainment/tautulli HelmRelease: entertainment/tautulli

+++ kubernetes/apps/entertainment/tautulli/app Kustomization: entertainment/tautulli HelmRelease: entertainment/tautulli

@@ -30,13 +30,13 @@

             env:
               TAUTULLI_HTTP_BASE_URL: https://tautulli.ok8.sh
               TAUTULLI_HTTP_PORT: 80
               TZ: America/Los_Angeles
             image:
               repository: ghcr.io/home-operations/tautulli
-              tag: 2.17.0@sha256:b90b30e15d1b6d12fc726fac1ef9778ad92f405ac8f8ccb30a34d7f6673c113d
+              tag: 2.17.1@sha256:2183820d45a1413b4b8868fc18ad5eb9259630ea0151348cdc9cfb4017a0dd33
             probes:
               liveness:
                 custom: true
                 enabled: true
                 spec:
                   failureThreshold: 3

[waifuz-bot]

--- HelmRelease: entertainment/tautulli Deployment: entertainment/tautulli

+++ HelmRelease: entertainment/tautulli Deployment: entertainment/tautulli

@@ -46,13 +46,13 @@

         - name: TAUTULLI_HTTP_BASE_URL
           value: https://tautulli.ok8.sh
         - name: TAUTULLI_HTTP_PORT
           value: '80'
         - name: TZ
           value: America/Los_Angeles
-        image: ghcr.io/home-operations/tautulli:2.17.0@sha256:b90b30e15d1b6d12fc726fac1ef9778ad92f405ac8f8ccb30a34d7f6673c113d
+        image: ghcr.io/home-operations/tautulli:2.17.1@sha256:2183820d45a1413b4b8868fc18ad5eb9259630ea0151348cdc9cfb4017a0dd33
         livenessProbe:
           failureThreshold: 3
           httpGet:
             path: /status
             port: 80
           initialDelaySeconds: 0