chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Update	Change
code.forgejo.org/forgejo/runner (source)	minor	13.1.0 → 13.2.0
netbirdio/netbird	minor	0.78.2 → 0.79.0
netbirdio/netbird-server	minor	0.78.2 → 0.79.0

---

Release Notes

forgejo/runner (code.forgejo.org/forgejo/runner)

v13.2.0

Compare Source

• User guide
• Administrator guide
• Container images

Release Notes

---

• features
  • PR: feat: efficient actions repo fetching
  • PR: feat: Upload Job summary
• bug fixes
  • PR: fix(jobparser): incomplete job definition triggers pre-execution-error inside a reusable workflow
  • PR: fix: don't panic when ctx cancellation occurs early in job startup
  • PR: fix(plugin): respect job timeout for environment lifetime
  • PR: fix(cleanup): remove a step's working copy, regardless of if the job ran
• other
  • PR: Update dependency buildx to v0.37.1
  • PR: Update module github.com/docker/cli to v29.8.1+incompatible
  • PR: Update module mvdan.cc/gofumpt to v0.12.0
  • PR: Update module golang.org/x/sys to v0.48.0
  • PR: Update module connectrpc.com/connect to v1.21.0
  • PR: Update module tags.cncf.io/container-device-interface to v1.1.1
  • PR: Update module github.com/moby/moby/client to v0.6.0
  • PR: Update module github.com/moby/moby/api to v1.56.0
  • PR: Update go toolchain directive to v1.26.8
  • PR: Update module github.com/docker/cli to v29.8.0+incompatible
  • PR: Update https://data.forgejo.org/actions/setup-forgejo action to v3.2.5
  • PR: Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.13.2
  • PR: Update forgejo-runner to v13.1.0

netbirdio/netbird (netbirdio/netbird)

v0.79.0

Compare Source

Release Notes for v0.79.0

New Feature: Desktop Light Mode

The desktop app now gives you three appearance options: System, Light, and Dark. Follow your operating system's theme or choose the look you prefer. The new light theme covers the connection view, settings, profiles, and dialogs, with matching native window appearance on Windows, macOS, and Linux. #​7344 by @​TechHutTV

This release also brings shared MDM policy enforcement to the mobile SDKs, a rootless Red Hat UBI container image, and improvements to DNS, relay connections, and reverse proxy access controls.

What's Changed

Desktop Client Improvements

• Fixed a Windows tray deadlock that could freeze the app when a double-click opened a window while another window was still being created. #​7449 by @​pappz
• Fixed the MDM settings snapshot so the UI correctly reports when remote jobs are managed by policy. #​7485 by @​pappz

Client Improvements

• Added MDM policy bridges and shared enforcement for the iOS and Android SDKs, keeping managed settings and profile restrictions consistent with the desktop client. #​6435 by @​riccardomanfrin
• Accepted MDM boolean values delivered as JSON numbers, so policies using 0 and 1 are applied correctly. #​7471 by @​riccardomanfrin
• Compared MDM-managed URLs by their normalized endpoints, avoiding false conflicts between equivalent URLs. #​7472 by @​riccardomanfrin
• Refreshed system information on every management sync reconnect, keeping local network addresses and posture information current after network changes. #​7409 by @​pappz
• Used host prefixes for Android TUN addresses so local network protection does not classify the entire overlay as a local network. #​7414 by @​pappz
• Replaced the eBPF DNS forwarder with UDP and TCP DNAT rules when the resolver cannot listen on port 53, with rollback and cleanup for incomplete redirects. #​7439 by @​lixmal
• Fixed a relay address race that could advertise a URL and IP from different connections during a reconnect. #​7498 by @​pappz
• Returned the context cancellation or timeout error when an SSH handshake is interrupted. #​7426 by @​pappz
• Updated wireguard-go to 8bf8fa968f1a, fixing keepalive buffer-pool stalls, keeping timer paths non-blocking, and making netstack interface shutdown idempotent. #​7532 by @​pappz
• Allowed buffer-pool limits to be adjusted while a device is stalled, and bounded proxy-wide updates so one stuck client does not block the others. #​7452 by @​riccardomanfrin

Management Improvements

• Restored networks using individual peers as routers in the SQLite network map when peer_groups is empty or null. #​7418 by @​mlsmaycon
• Fixed SQLite network-map reads for users with null automatic groups and expanded coverage for empty and null router groups. #​7425 by @​dmitri-netbird
• Included offline peers when scheduling login expiration and ensured expired peers are disconnected, while protecting peers that have just logged in again. #​7467 by @​pascal-fischer
• Applied duplicate-key sync protection to user-owned peers as well as peers registered with setup keys. #​7427 by @​pascal-fischer
• Validated that a peer exists before adding it to a group. #​7486 by @​pascal-fischer
• Prevented other users from deleting the account owner. #​7456 by @​pascal-fischer
• Hardened OIDC issuer validation by requiring HTTPS, rejecting credentials, query strings, and fragments in issuer URLs, refusing discovery redirects, and limiting discovery response size. #​7435 by @​bcmmbaga
• Cleaned up resources when WebSocket-to-gRPC proxy connections close. #​7484 by @​dmitri-netbird

Agent Network

• Added managed proxy provisioning endpoints and response types to the API specification. #​7433 by @​bison
• Prevented deletion of groups referenced by Agent Network budget rules, preserving the rules' spending limits. #​7450 by @​Tyagiquamar

Reverse Proxy Improvements

• Added NB_PROXY_UPSTREAM_HTTP_VERSION with auto, 1.1, and 2 options. The default auto mode negotiates with HTTPS upstreams and falls back to HTTP/1.1 when an upstream's negotiated HTTP/2 connection fails at the protocol level. #​7410 by @​lixmal
• Enforced group access both when issuing session cookies and when accepting existing sessions. #​7240 by @​lixmal
• Required custom domain validation before creating a service or moving one to a different custom domain. #​7341 by @​mlsmaycon
• Added a 48-hour validation window for custom domain registrations. Existing pending registrations receive a fresh window on upgrade; expired registrations are removed unless they still have services attached. #​7497 by @​mlsmaycon
• Rejected unsupported direct-upstream IP addresses, including loopback, multicast, link-local, and IPv6 addresses with zone identifiers. #​7400 by @​dmitri-netbird
• Validated domain names before creating certificate lock files. #​7501 by @​pascal-fischer

Self-Hosting Improvements

• Added a rootless Red Hat UBI image for AMD64 and ARM64, published with the 0.79.0-rootless-ubi tag. #​7469 by @​jnfrati
• Supported arbitrary non-root UIDs without a passwd entry, as used by OpenShift. #​7440 by @​jnfrati
• Added RPM dependencies, license and documentation files, a generated changelog, and an example /etc/sysconfig/netbird to meet Red Hat software certification packaging requirements. #​7562, #​7573 by @​mlsmaycon
• Kept deployments using the embedded identity provider on a single account, with stricter configuration checks and migration handling. #​7380 by @​bcmmbaga
• Passed the combined server's TLS configuration through to the management listener. #​7499 by @​pascal-fischer
• Updated peer connection-IP extraction to honor configured TrustedPeers, with X-Forwarded-For taking precedence over X-Real-IP. The final release preserves trust in all IPv4 and IPv6 sources when TrustedPeers is empty; configure your reverse proxy's address or network to restrict which sources can supply forwarded-IP headers. #​7454, #​7589 by @​bcmmbaga; #​7561, #​7577 by @​dmitri-netbird and @​bcmmbaga

Internal, CI, and Docs

• Added atomic SetNX and GetDel cache operations. #​7084 by @​bcmmbaga
• Allowed binaries embedding management to extend its command tree. #​7483 by @​bison
• Extracted peer update handling and added test coverage. #​7338 by @​dmitri-netbird
• Replaced a hard-coded temporary directory in WebSocket adapter tests with the platform's temporary directory. #​7503 by @​dmitri-netbird
• Switched the MinIO test image to quay.io after it became unavailable on Docker Hub. #​7516 by @​Silex
• Preserved image variant suffixes in snapshot tags. #​7511 by @​jnfrati
• Skipped the protobuf breaking-change check on branch-creation pushes, which have no previous commit to compare against. #​7411 by @​bison

---

Full Changelog: v0.78.0...v0.79.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Claude finished @5ym's task in 1m 2s —— View job

---

レビュー完了

• コンテキスト取得・差分確認
• リポジトリ設定 (netbird/forgejo 設定) の確認
• forgejo-runner 13.1.0 → 13.2.0 のリリースノート確認
• netbird 0.78.2 → 0.79.0 のリリースノート確認 (破壊的変更の有無)
• レビューコメント投稿

変更内容

• apps/forgejo/runner.yaml: code.forgejo.org/forgejo/runner 13.1.0 → 13.2.0
• apps/netbird/deployment.yaml, apps/netbird/routing-peer.yaml: netbirdio/netbird(-server) 0.78.2 → 0.79.0

いずれも設定ファイルのイメージタグ変更のみで、ロジック変更やテスト対象コードはありません。

forgejo-runner 13.2.0

リリースノート(code.forgejo.org/forgejo/runner v13.2.0)を確認しました。破壊的変更は無く、fix(plugin): respect job timeout for environment lifetime や fix(cleanup): remove a step's working copy などはバグ修正で、この設定 (apps/forgejo/runner.yaml) の timeout: 3h / capacity: 8 の運用方針を変える必要はありません。feat: Upload Job summary はオプトインの新機能で、既存動作への影響なしと判断します。

netbird / netbird-server 0.79.0

本文中の release notes (v0.78.2...v0.79.0) を確認しました。この更新の中で唯一この構成に関係しうるのは以下の項目です:

Updated peer connection-IP extraction to honor configured TrustedPeers, with X-Forwarded-For taking precedence over X-Real-IP. The final release preserves trust in all IPv4 and IPv6 sources when TrustedPeers is empty; configure your reverse proxy's address or network to restrict which sources can supply forwarded-IP headers.

apps/netbird/server-config.yaml を確認したところ、reverseProxy.trustedHTTPProxies: ["10.42.0.0/16"](k3s Pod CIDR)がすでに明示的に設定されており、「空のときは全ソースを信頼する」ケースには該当しません。したがって今回の更新によるセキュリティ上の後退はありません。

その他の変更(DNS の eBPF→DNAT フォールバック、rootless UBI イメージ追加、MDM 関連、デスクトップの Light Mode など)はこのリポジトリの Kubernetes 上の combined サーバ/routing peer 構成には影響しません。

結論

特に問題は見当たりません。マイナーバージョンの更新のみで、既存設定との不整合や破壊的変更もないため、このまま merge して問題ないと考えます。