Update Container images

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
authelia/authelia (source)		patch	4.39.20 → 4.39.22
crowdsecurity/crowdsec		patch	v1.8.0 → v1.8.1
docker.n8n.io/n8nio/n8n (source)		patch	2.38.2 → 2.38.3
ghcr.io/berriai/litellm (source)		minor	v1.99.1 → v1.100.0
lscr.io/linuxserver/homeassistant (source)		minor	2026.8.3 → 2026.9.1
ollama/ollama		patch	0.33.2 → 0.33.3
qdrant/qdrant (source)		patch	v1.19.0 → v1.19.1
supabase/edge-runtime		patch	v1.76.1 → v1.76.2
supabase/logflare		patch	1.50.7 → 1.50.9
supabase/postgres		patch	15.14.1.167 → 15.14.1.168
supabase/realtime		minor	v2.133.0 → v2.134.6
supabase/storage-api		minor	v1.72.4 → v1.73.0
traefik (source)	final	patch	v3.7.12 → v3.7.13

---

Release Notes

authelia/authelia (authelia/authelia)

v4.39.22

Compare Source

Bug Fixes

• storage: access token jwt upgrade (#​12958) (84e41e5), closes #​12957 by @​james-d-elliott

Docker Container

• docker pull authelia/authelia:4.39.22
• docker pull ghcr.io/authelia/authelia:4.39.22

v4.39.21

Compare Source

Bug Fixes

• api: missing and misleading endpoints (#​12728) (b6de5c0) by @​james-d-elliott
• authentication: pooled client skip (#​12554) (7c34973) by @​james-d-elliott
• authentication: stale user database aliases (#​12755) (0c310f9) by @​james-d-elliott
• authentication: uncessary read lock (#​12620) (e0c4097) by @​james-d-elliott
• authorization: deprecated wildcard consistency and did (#​12340) (aed96e8) by @​james-d-elliott
• configuration: add authelia.pam to scopes in schema (#​12705) (d769794) by @​hendrik1120
• configuration: jwk type direct not usable (#​12756) (8942052) by @​james-d-elliott
• correct defects across the web frontend and the suites (#​12804) (daec9a3) by @​nightah
• data structure issues (#​12704) (deadaf9) by @​james-d-elliott
• handlers: always log proper error (#​12595) (8d57d0c) by @​Crowley723
• handlers: incorrect middleware use (#​12339) (62b73a7) by @​james-d-elliott
• handlers: use regeneration more frequently (#​12858) (bf517e6) by @​james-d-elliott
• handler: treat empty basic parameter as malformed (#​12550) (2299998) by @​james-d-elliott
• logging: incorrect multi writer order (#​12761) (ff9db2c) by @​james-d-elliott
• metrics: missing record invocation (#​12267) (a9a5c65) by @​james-d-elliott
• middlewares: include the error a session was not retrieved with (#​12868) (e77f3ac) by @​nightah
• ntp: strict response validation (#​12551) (4c26b9d) by @​james-d-elliott
• oidc: client credentials at jwt missing sub (#​12372) (1a1fdb2) by @​james-d-elliott
• random: nominal entropy reduction (#​12765) (503e292) by @​james-d-elliott
• service: stale errors and shutdown blocks (#​12762) (01fa1df) by @​james-d-elliott
• storage: use aad and hkdf (#​12447) (404331c) by @​james-d-elliott
• storage: webauthn issuer aad derivation (#​12754) (760a4b6) by @​james-d-elliott
• templates: ineffectual checksum functions (#​12757) (30ffca5) by @​james-d-elliott
• utils: domain canonical case handling (#​12146) (368631e) by @​james-d-elliott

Performance Improvements

• server: serve pre-compressed embedded assets (#​12816) (402eb4d) by @​nightah

New Contributors

• @​Samuel-BF made their first contribution in #​12411
• @​mvanhorn made their first contribution in #​12446
• @​TowyTowy made their first contribution in #​12484
• @​jmp1985 made their first contribution in #​12307
• @​LilPhyziX made their first contribution in #​12515
• @​Alvinwylim made their first contribution in #​12331
• @​tuxinaut made their first contribution in #​12588
• @​mrrudy made their first contribution in #​12618
• @​sa20001 made their first contribution in #​12528
• @​Dacid99 made their first contribution in #​12692
• @​Eugeny made their first contribution in #​12763
• @​Christoph-Wagner made their first contribution in #​12764
• @​helgeklein made their first contribution in #​12780

Docker Container

• docker pull authelia/authelia:4.39.21
• docker pull ghcr.io/authelia/authelia:4.39.21

crowdsecurity/crowdsec (crowdsecurity/crowdsec)

v1.8.1

Compare Source

This release fixes a false positive in the bot detection feature for Brave Browser with shields enabled.

Changes

Improvements

• add HasValidChallengeCookie() helper (#​4648) @​blotus

Bug Fixes

• lapi: return an empty slice instead of null when querying alerts (#​4653) @​blotus
• challenge: tolerate strings instead of struct in FP payload (#​4655) @​blotus

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

n8n-io/n8n (docker.n8n.io/n8nio/n8n)

v2.38.3

Bug Fixes

• core: Ensure running job cleanup when a workflow run rejects (#​37629) (cebb7bd)

BerriAI/litellm (ghcr.io/berriai/litellm)

v1.100.0

Compare Source

qdrant/qdrant (qdrant/qdrant)

v1.19.1

Compare Source

Change log

Improvements

• #​10342, #​10420 - Speed up and saturate memory bandwidth in quantized scoring with prefetching
• #​10391, #​10392, #​10362, #​10437, #​10439, #​10381 - Rework and batch 4-bit TurboQuant SIMD implementation for better performance
• #​10441 - Limit query plane allocations for better search performance
• #​8650 - Improve L2 cosine preprocessing performance on AVX
• #​10042 - Batch deletion checks for faster full scans
• #​10054, #​10010, #​10194 - Batch searches in HNSW for faster search
• #​10099 - Skip bad items before pushing into HNSW priority queue
• #​10312, #​10333 - Skip point ID resolution in search post processing to improve search performance
• #​10040, #​10066 - Use raw payloads in shard transfer to make payload heavy shard transfers 1.5x faster
• #​9760 - Make set replica state and abort transfer/resharding crash safe to prevent consensus desync
• #​9786 - Make restart transfer operation crash safe to prevent consensus desync
• #​10345 - Query shard status more efficiently, don't build full segment info
• #​10455 - Faster memory reporting on Linux with cachestat
• #​10457 - Probe segment memory utilization outside of read locks
• #​10027 - Honor max_segment_size on filter based updates
• #​10426 - Support fast HNSW healing cancellation to prevent blocking consensus on shard drop
• #​10306 - Raise HTTP2 max pending resets on gRPC API to allow higher connection concurrency
• #​10243 - Expose used CPU cores in /metrics (cpu_cores_used)
• #​10132 - Extend container runtime detection, include Kubernetes and other runtimes

Bug Fixes

• #​10201 - Fix data consistency, flush CoW segments before building payload index
• #​10399 - Fix Gridstore panic on new page after unsafe shutdown, repairs preexisting failures
• #​10205 - On aborting resharding down, don't block consensus with deferred points for along time
• #​10324 - Reject vector size larger than 65536
• #​10143 - Reject empty dense vectors
• #​10374 - Reject mismatched dimension count in positive/negative examples of recommend average API
• #​10382 - Not specifying scroll limit would bypass max_query_limit
• #​10128 - Prevent underestimating is_empty and is_null cardinality
• #​10101 - Fix is_null filter for unindexed payload fields
• #​10341 - Fix phrase matching on unindexed payload field not respecting token positioning
• #​10181 - Propagate mmap read errors back to user rather than panicking
• #​10338 - Fix concurrent consensus operations awaiters dropping each other
• #​9957 - Limit tracing ID by 256 bytes, not characters
• #​9959 - Clamp picking random HNSW layer to lower bound of zero

Security

• #​10242 - Reject . and .. in collection names

traefik/traefik (traefik)

v3.7.13

Compare Source

All Commits

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#​13759 @​ldez)
• [acme] Disable recursive nss propagation by default for DNS challenge (#​13830 @​rtribotte)
• [acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge (#​13710 @​amazon7737)
• [acme, tls] Ignore negated matchers when parsing rule domains (#​13725 @​rtribotte)
• [consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers (#​13741 @​rtribotte)
• [http3] Dedicate a transport per HTTP/3 client connection (#​13812 @​sdelicata)
• [k8s/ingress-nginx] Fix sticky cookie expiration per request (#​13496 @​makaiver)
• [k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect (#​13457 @​mmatur)
• [k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute (#​13456 @​mmatur)
• [logs, middleware] Set access log entry level and time before formatting the OTLP body (#​13767 @​emilevauge)
• [logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning (#​13780 @​lazerg)
• [middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme (#​13320 @​AnouarMohamed)
• [middleware, authentication] Prevent user enumeration through the basic auth singleflight key (#​13816 @​sdelicata)
• [server] Build the configuration copy once per change (#​13746 @​jspdown)
• [server] Do not forward h2c upgrade headers to the backend (#​13797 @​sdelicata)
• [server] Deny request with an opaque request target (#​13796 @​sdelicata)
• [server] Do not forward request trailer values to the backend (#​13822 @​rtribotte)
• [server] Bump github.com/quic-go/quic-go to v0.62.0 (#​13807 @​Nelwhix)
• [tls] Redact duplicate TLS certificates in provider merge logs (#​13548 @​xsergos)
• [webui] Fix displayed number on details pages (#​13779 @​gndz07)

Documentation:

• [k8s] Add warning about Ingress API frozen state (#​13783 @​jnoordsij)
• [k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector (#​13790 @​jnoordsij)
• [k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs (#​13811 @​thev1ndu)
• Tell scanning agents to read the security policy and decisions pages (#​13753 @​emilevauge)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.