TrueCharts Bot
57b8f36bfe
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/drakkan/sftpgo](https://redirect.github.com/drakkan/sftpgo) | patch | `036a669` → `4d47ba4` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/18710) for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes <details> <summary>drakkan/sftpgo (ghcr.io/drakkan/sftpgo)</summary> ### [`v2.7.3`](https://redirect.github.com/drakkan/sftpgo/releases/tag/v2.7.3) [Compare Source](https://redirect.github.com/drakkan/sftpgo/compare/v2.7.1...v2.7.3) ##### New features - Added a configurable minimum-entropy check (`common.secret_min_entropy`, default 80) for data-at-rest encryption secrets (CryptFs passphrase, S3 SSE-C key), to reject trivially weak key material at submission time. - Logs: added the virtual path to transfer/command logs and to event-log CSV exports. - WebClient: replaced glightbox with a custom lightbox implementation for better CSP compatibility. ##### Bug fixes - IP list: fixed matching when an IP is covered by multiple conflicting entries. - Fixed comparison of unordered slices. - Shares: enforce `max_tokens` atomically via a guarded conditional update, closing a check-then-write race that could let a usage-capped share be used more times than allowed under concurrent access. - In-memory reset-code manager: check code expiry at retrieval time instead of relying only on the background cleanup. ##### Security fixes - Fixed a path-confinement bypass in the public browsable-share partial ZIP download. CVE-2026-49244. - Fixed a stored XSS where the `inline` parameter on browsable-share and authenticated user file downloads suppressed `Content-Disposition: attachment`, allowing an attacker-supplied HTML file to execute in SFTPGo's web origin. These endpoints now always respond with `Content-Disposition: attachment` and the `inline` parameter has been removed. CVE-2026-49245. ##### Hardening - Neutralized CSV formula injection in the Event Manager and event-log CSV exports: cells starting with `=`, `+`, `-`, `@`, tab or CR are now prefixed with a single quote. - Username, folder, group and other object names now reject invisible Unicode formatting characters (e.g. zero-width joiners, bidirectional overrides, BOM) and line/paragraph separators, preventing the creation of invisible or visually confusable names and newline-like codepoints that could appear in paths and logs. - WebClient: trigger a defender event on share login failure. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC9zZnRwZ28iLCJhdXRvbWVyZ2UiLCJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->
title
| title |
|---|
| TrueCharts |
Community Helm Chart Catalog
TrueCharts is a catalog of highly optimised Helm Charts. Made for the community, by the community!
All our charts are supposed to work together and be easy to setup using any helm-compatible deployment tool, above all, give the average user more than enough options to tune things to their liking.
Getting started using TrueCharts
Support
Please check our FAQ, manual and Issue tracker There is a significant chance your issue has been reported before!
Still something not working as expected? Contact us! and we'll figure it out together!
Development
Our development process is fully distributed and agile, so every chart-maintainer is free to set their own roadmap and development speed and does not have to comply to a centralised roadmap. This ensures freedom and flexibility for everyone involved and makes sure you, the end user, always has the latest and greatest of every Chart installed.
Getting into creating Charts
For more information check the website: https://truecharts.org
Contact and Support
To contact the TrueCharts project:
-
Create an issue on Github issues
-
Open a Support Ticket
-
Send us an email
Contributors ✨
Thanks goes to these wonderful people (emoji key):
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4?s=100)
![allcontributors[bot]](https://avatars.githubusercontent.com/in/23186?v=4?s=100)
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4?s=100)
This project follows the all-contributors specification. Contributions of any kind welcome!
Licence
Truecharts, is primarily based on the AGPL-v3 license, this ensures almost everyone can use and modify our charts. Licences can vary on a per-Chart basis. This can easily be seen by the presence of a "LICENSE" file in that folder.
An exception to this, has been made for every document inside folders labeled as docs or doc and their subfolders: those folders are not licensed under AGPL-v3 and are considered "all rights reserved". Said content can be modified and changes submitted per PR, in accordance to the github End User License Agreement.
SPDX-License-Identifier: AGPL-3.0
