From d20987aaaf89a2f52dc9d75c807558810d2d5885 Mon Sep 17 00:00:00 2001 From: TrueCharts Bot Date: Thu, 23 Oct 2025 23:37:18 +0200 Subject: [PATCH] =?UTF-8?q?chore(helm):=20update=20image=20ghcr.io/drakkan?= =?UTF-8?q?/sftpgo=20v2.6.6=20=E2=86=92=20v2.7.0=20(#41031)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/drakkan/sftpgo](https://redirect.github.com/drakkan/sftpgo) | minor | `722c6cf` -> `f31c63e` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes
drakkan/sftpgo (ghcr.io/drakkan/sftpgo) ### [`v2.7.0`](https://redirect.github.com/drakkan/sftpgo/releases/tag/v2.7.0) [Compare Source](https://redirect.github.com/drakkan/sftpgo/compare/v2.6.6...v2.7.0) #### v2.7.0 ##### New Features - SFTPD: Added support for Post-Quantum Traditional Hybrid Key Exchange through the newly added algorithm `mlkem768x25519-sha256`. - JWT: replace jwtauth/jwx with lightweight wrapper around go-jose. Implementing our own wrapper simplifies the codebase and improves maintainability. Moreover, go-jose depends only on the standard library, resulting in a leaner dependency that still meets all our requirements. - WebUI: add French and German translations. - Public shares: show disclaimer on login page. - Enable setting password change requirements in user templates. - DataProvider: preserve the initial sort order for related resources (such as folders and groups), improving compatibility and predictability when managing them with Terraform. - Various internal refactoring, bug fixes, and minor improvements. ##### Bug Fixes - OIDC: allow login if the password method is disabled. - OIDC: ensure token username adheres to configured naming conventions. ##### Backward incompatible changes - Removed Git support. Hosting Git repositories over SSH falls outside the intended scope of a file transfer solution, and the use of external commands introduces unnecessary security risks by increasing the attack surface. For example, a user could upload a Git repository containing custom hooks to their SFTPGo folder; when they push to the repository, a Git pre-receive hook shell script would be executed with the privileges of the `sftpgo` user. Thanks to [@​hyperreality](https://redirect.github.com/hyperreality) for the detailed report. - Removed rsync support. In the previous versions, `rsync` was executed as an external command, which means we have no insight into or control over what it actually does. From a security perspective, this is far from ideal. To be clear, there's nothing inherently wrong with `rsync` itself. However, if we were to support it properly within SFTPGo, we would need to implement the low-level protocol internally rather than relying on launching an external process. This would ensure it works seamlessly with any storage backend, just as SFTP does, for example. We recommend using one of the many alternatives that rely on the SFTP protocol, such as `rclone`. - Remove startsubsys command: SFTPGo is not designed to be used as an OpenSSH subsystem: many features do not work correctly in subsystem mode. The functionality was added after a user request in the `pkg/sftp` repository to demonstrate that it was feasible using `pkg/sftp`, not for actual practical use. - Removed legacy data retention REST API, use the EventManager instead. ##### Windows binaries Starting with this release, Windows binaries for SFTPGo will no longer be signed. Over the past year, we’ve been using Azure Trusted Signing to obtain a personal code signing certificate. Unfortunately, due to changes in Azure’s policies, renewing that certificate is no longer possible. For this release, I manually downloaded and signed the Windows installer generated via GitHub Actions using a new company certificate, which required offline signing. However, the binaries included in the installer are not individually signed. Since manually downloading and signing each new installer is not a sustainable process, future Windows releases may be distributed without code signing. We understand that signed binaries can make installation easier and build trust, and we’ll keep evaluating possible solutions for automated and transparent signing in the future.
--- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). --- charts/stable/sftpgo/Chart.yaml | 4 ++-- charts/stable/sftpgo/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/stable/sftpgo/Chart.yaml b/charts/stable/sftpgo/Chart.yaml index 9495add160a..5885e41cb7a 100644 --- a/charts/stable/sftpgo/Chart.yaml +++ b/charts/stable/sftpgo/Chart.yaml @@ -11,7 +11,7 @@ annotations: truecharts.org/min_kubernetes_version: 1.24.0 truecharts.org/train: stable apiVersion: v2 -appVersion: 2.6.6 +appVersion: 2.7.0 dependencies: - name: common version: 28.26.1 @@ -39,5 +39,5 @@ sources: - https://github.com/truecharts/charts/tree/master/charts/stable/sftpgo - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/sftpgo type: application -version: 9.11.1 +version: 9.12.0 diff --git a/charts/stable/sftpgo/values.yaml b/charts/stable/sftpgo/values.yaml index c336e90fc10..598ea856068 100644 --- a/charts/stable/sftpgo/values.yaml +++ b/charts/stable/sftpgo/values.yaml @@ -1,7 +1,7 @@ image: pullPolicy: IfNotPresent repository: ghcr.io/drakkan/sftpgo - tag: v2.6.6-plugins@sha256:722c6cfe140d9334115e049da8cb199df346d80afe2786fea64372800f826eb4 + tag: v2.7.0-plugins@sha256:f31c63ecbb1633126010d0fc16d60cab0621a6e586ef3e7cabc4cc43990abf01 securityContext: container: runAsNonRoot: false