chore(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
axllent/mailpit (source)		minor	v1.30 → v1.31
libops/.github (changelog)	workflow	digest	ac5db17 → 782ba8f
libops/base		digest	aa0c610 → 57b396f
libops/mariadb		digest	7e0eb90 → 52bc6b8
libops/ojs	final	digest	f70fc96 → b208160
traefik (source)		patch	v3.7.9 → v3.7.13

---

Release Notes

axllent/mailpit (axllent/mailpit)

v1.31

Security

• Add --allowed-hosts flag to mitigate DNS rebinding against the API

Chore

• Update Go dependencies
• Update node dependencies
• Update Github Actions

Fix

• Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
• Pass line-boundary state to drainData to prevent SMTP desync
• Allow SP inside quoted local-parts per RFC 5321 (#​731)
• Bound header-rewrite scanner to header block and fail closed on missing header
• Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup

traefik/traefik (traefik)

v3.7.13

Compare Source

All Commits

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#​13759 @​ldez)
• [acme] Disable recursive nss propagation by default for DNS challenge (#​13830 @​rtribotte)
• [acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge (#​13710 @​amazon7737)
• [acme, tls] Ignore negated matchers when parsing rule domains (#​13725 @​rtribotte)
• [consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers (#​13741 @​rtribotte)
• [http3] Dedicate a transport per HTTP/3 client connection (#​13812 @​sdelicata)
• [k8s/ingress-nginx] Fix sticky cookie expiration per request (#​13496 @​makaiver)
• [k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect (#​13457 @​mmatur)
• [k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute (#​13456 @​mmatur)
• [logs, middleware] Set access log entry level and time before formatting the OTLP body (#​13767 @​emilevauge)
• [logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning (#​13780 @​lazerg)
• [middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme (#​13320 @​AnouarMohamed)
• [middleware, authentication] Prevent user enumeration through the basic auth singleflight key (#​13816 @​sdelicata)
• [server] Build the configuration copy once per change (#​13746 @​jspdown)
• [server] Do not forward h2c upgrade headers to the backend (#​13797 @​sdelicata)
• [server] Deny request with an opaque request target (#​13796 @​sdelicata)
• [server] Do not forward request trailer values to the backend (#​13822 @​rtribotte)
• [server] Bump github.com/quic-go/quic-go to v0.62.0 (#​13807 @​Nelwhix)
• [tls] Redact duplicate TLS certificates in provider merge logs (#​13548 @​xsergos)
• [webui] Fix displayed number on details pages (#​13779 @​gndz07)

Documentation:

• [k8s] Add warning about Ingress API frozen state (#​13783 @​jnoordsij)
• [k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector (#​13790 @​jnoordsij)
• [k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs (#​13811 @​thev1ndu)
• Tell scanning agents to read the security policy and decisions pages (#​13753 @​emilevauge)

v3.7.12

Compare Source

All Commits

Bug fixes:

• [fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 (#​13769 @​mmatur)
• [file] Include the filename in file provider configuration errors (#​13527 @​lazerg)
• [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#​13717 @​gndz07)
• [k8s] Fix typos in docs and an OCSP log message (#​13722 @​MsfPablo)
• [k8s, k8s/ingress-nginx] Fix redirect www host with a non-numeric port (#​13708 @​mmatur)
• [k8s/ingress-nginx] Fix TLS option name collision across namespaces in the ingress-nginx provider (#​13721 @​gndz07)
• [server] Add an entry point option to handle request headers with aliasing names (#​13720 @​rtribotte)
• [tcp, udp] Reject negative weights in TCP and UDP weighted services (#​13749 @​rtribotte)
• Bump etcd client modules to v3.5.33 (#​13756 @​mmatur)

Documentation:

• [k8s] Update redirections block reference in basic.md (#​13723 @​Larzenegger)
• [k8s] Fix formatting in Kubernetes setup guide (#​13742 @​stefkiourk)
• [security] Document the security threat model and settled security decisions (#​13740 @​emilevauge)
• [service] Clarify ServersTransport behavior for the errors middleware in Kubernetes (#​13531 @​lazerg)
• Fix v3.7.11 migration guide (#​13730 @​gndz07)
• Move Jean-Baptiste Doumenjou and Mathieu Lonjaret to past maintainers (#​13736 @​emilevauge)
• Reduce SECURITY.md to a pointer to the security documentation (#​13732 @​emilevauge)
• Update end of support dates (#​13712 @​nmengin)

v3.7.11

Compare Source

All Commits

Bug fixes:

• [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#​13635 @​gndz07)
• [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#​13688 @​jnoordsij)
• [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#​13656 @​rtribotte)
• [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#​13665 @​rtribotte)
• [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider (#​13668 @​rtribotte)
• [k8s/crd] Name failover generated services after the referenced Kubernetes Service (#​13677 @​rtribotte)
• [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider (#​13689 @​gndz07)
• [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect (#​13641 @​gndz07)
• [k8s/gatewayapi] Fix Gateway API router rules (#​13645 @​rtribotte)
• [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider (#​13638 @​gndz07)
• [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend (#​13575 @​rtribotte)
• [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider (#​13629 @​gndz07)
• [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware (#​13670 @​gndz07)
• [middleware, authentication] Bump github.com/containous/go-http-auth to b975dca (#​13636 @​kevinpollet)
• [tls] Add an option to disable the fallback to the default TLS options (#​13639 @​rtribotte)
• Bump golang.org/x dependencies (#​13699 @​mmatur)

Documentation:

• [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation (#​13609 @​rtribotte)
• [api] Fix doubled word in API/dashboard reference docs (#​13663 @​latent-9)
• [docker] Remove :ro from docker.sock (#​12656 @​bluepuma77)
• [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 (#​13628 @​rtribotte)
• [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider (#​13634 @​rtribotte)
• [k8s/ingress-nginx] Docs: Update supported server snippet directives (#​13687 @​rtsui-harmonicinc)
• [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example (#​13664 @​amazon7737)
• [middleware] Mark the errors middleware service option as required (#​13684 @​lazerg)
• [tls] Document the TLS options conflict resolution (#​13640 @​rtribotte)
• [tls] Clarify router TLS replaces entrypoint TLS (#​13630 @​sornapudisuresh)
• Document Redis keyspace notifications requirement (#​13691 @​omkar619-dev)
• Remove retired Go Report Card badge (#​13637 @​yardenshoham)
• Restore the systemd socket activation documentation (#​13701 @​lazerg)
• Update version support policy starting with v3.6 (#​13627 @​nmengin)

v3.7.10

Compare Source

All Commits

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#​13547 @​ldez)
• [middleware, authentication] Fix auth singleflight key collision (#​13572 @​mmatur)
• [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#​13580 @​gndz07)
• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#​13530 @​kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#​13574 @​mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#​13573 @​gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#​13587 @​mmatur)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 (#​13589 @​rtribotte)

Documentation:

• [k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider (#​13607 @​gndz07)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.