fix(sftpgo): update image ghcr.io/drakkan/sftpgo v2.7.1 → v2.7.3 (#48653)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/drakkan/sftpgo](https://redirect.github.com/drakkan/sftpgo) |
patch | `036a669` → `4d47ba4` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>drakkan/sftpgo (ghcr.io/drakkan/sftpgo)</summary>

###
[`v2.7.3`](https://redirect.github.com/drakkan/sftpgo/releases/tag/v2.7.3)

[Compare
Source](https://redirect.github.com/drakkan/sftpgo/compare/v2.7.1...v2.7.3)

##### New features

- Added a configurable minimum-entropy check
(`common.secret_min_entropy`, default 80) for data-at-rest encryption
secrets (CryptFs passphrase, S3 SSE-C key), to reject trivially weak key
material at submission time.
- Logs: added the virtual path to transfer/command logs and to event-log
CSV exports.
- WebClient: replaced glightbox with a custom lightbox implementation
for better CSP compatibility.

##### Bug fixes

- IP list: fixed matching when an IP is covered by multiple conflicting
entries.
- Fixed comparison of unordered slices.
- Shares: enforce `max_tokens` atomically via a guarded conditional
update, closing a check-then-write race that could let a usage-capped
share be used more times than allowed under concurrent access.
- In-memory reset-code manager: check code expiry at retrieval time
instead of relying only on the background cleanup.

##### Security fixes

- Fixed a path-confinement bypass in the public browsable-share partial
ZIP download. CVE-2026-49244.
- Fixed a stored XSS where the `inline` parameter on browsable-share and
authenticated user file downloads suppressed `Content-Disposition:
attachment`, allowing an attacker-supplied HTML file to execute in
SFTPGo's web origin. These endpoints now always respond with
`Content-Disposition: attachment` and the `inline` parameter has been
removed. CVE-2026-49245.

##### Hardening

- Neutralized CSV formula injection in the Event Manager and event-log
CSV exports: cells starting with `=`, `+`, `-`, `@`, tab or CR are now
prefixed with a single quote.
- Username, folder, group and other object names now reject invisible
Unicode formatting characters (e.g. zero-width joiners, bidirectional
overrides, BOM) and line/paragraph separators, preventing the creation
of invisible or visually confusable names and newline-like codepoints
that could appear in paths and logs.
- WebClient: trigger a defender event on share login failure.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC9zZnRwZ28iLCJhdXRvbWVyZ2UiLCJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

charts/stable/sftpgo/Chart.yaml

@@ -9,7 +9,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 2.7.1
+appVersion: 2.7.3
 dependencies:
   - name: common
     version: 29.3.4
@@ -36,5 +36,5 @@ sources:
   - https://github.com/drakkan/sftpgo
   - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/sftpgo
 type: application
-version: 10.3.0
+version: 10.3.1
 

charts/stable/sftpgo/values.yaml

@@ -2,7 +2,7 @@
 image:
   pullPolicy: IfNotPresent
   repository: ghcr.io/drakkan/sftpgo
-  tag: v2.7.1-plugins@sha256:036a6695a13e227300f2728ee98d62f5ad18d78495173bca1a1450278f1f783f
+  tag: v2.7.3-plugins@sha256:4d47ba4007a1ddf08739ff4af61b7cec94e8327e57721776bd3f204c029b90d0
 securityContext:
   container:
     runAsNonRoot: false