Skip to content

Update lscr.io/linuxserver/radarr:6.1.1 Docker digest to c0a4335#3318

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/lscr.io-linuxserver-radarr-6.1.1
Open

Update lscr.io/linuxserver/radarr:6.1.1 Docker digest to c0a4335#3318
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/lscr.io-linuxserver-radarr-6.1.1

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 31, 2026

This PR contains the following updates:

Package Update Change
lscr.io/linuxserver/radarr (source) digest 079e488c0a4335

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@anshulg-dep-review
Copy link
Copy Markdown
Contributor

anshulg-dep-review Bot commented May 31, 2026

Triage: YELLOW -- possible breakage, reviewer requested

Quick summary

Same-version tag with digest rotation on lscr.io/linuxserver/radarr:6.1.1. The breaking-change researcher confirms this is a safe package-only update (Radarr application version unchanged, both amd64 and arm64 CI pass), and the changelog researcher identified a security patch to libxml2 addressing CVE-2025-49795 and CVE-2025-49796. However, the provenance researcher failed to complete due to token limits, leaving the source correspondence and publisher identity unverified. Manual verification of the digest source is required before merge.

Updates table

Package Old New Breaking Changelog Provenance
lscr.io/linuxserver/radarr 6.1.1@sha256:079e488 6.1.1@sha256:c0a4335 safe security patch failed

Required actions

  1. lscr.io/linuxserver/radarr -- Provenance research failed due to token limits. Before merge, manually verify that digest c0a4335 corresponds to the expected LinuxServer release 6.1.1.10360-ls304 from the official linuxserver/docker-radarr repository. (See provenance report failure note below.)

Update summary

lscr.io/linuxserver/radarr 6.1.1@sha256:079e488 → 6.1.1@sha256:c0a4335

  • Digest rotation on the same Radarr application version (6.1.1.10360); no application code changes.
  • LinuxServer package refresh: libxml2 bumped from 2.13.9-r0 to 2.13.9-r1 to address CVE-2025-49795 (NULL pointer dereference in XPath, DoS) and CVE-2025-49796 (memory corruption via schema elements, DoS/undefined behavior).
  • Both amd64 and arm64 architectures pass LinuxServer CI; arm64 confirmed for rpi5 deployment.
  • No configuration, schema, or environment variable changes; no impact on dependent services (radarr-backup CronJob, oauth-proxy Deployment).

Provenance

Provenance research failed. The provenance researcher could not complete due to token limits and was unable to verify the source correspondence or publisher identity for digest c0a4335. The breaking-change and changelog researchers both successfully resolved the digest to LinuxServer release 6.1.1.10360-ls304 (commit 069832c, published 2026-05-31) from the official linuxserver/docker-radarr repository. Manual verification is required before merge to confirm the digest maps to the expected release.


Sub-agent reports -- lscr.io/linuxserver/radarr

Breaking-change impact

I now have all the information I need. The CI test results confirm both AMD64 and ARM64 pass. The new digest c0a4335 corresponds to release 6.1.1.10360-ls304 published 2026-05-31, which is a package version update only — the only change in the linuxserver/docker-radarr master commit was package_versions.txt (1 addition, 1 deletion). The Radarr application version remains 6.1.1.10360 unchanged. Both architectures pass CI.


Impact verdict: lscr.io/linuxserver/radarr 6.1.1@sha256:079e488 → 6.1.1@sha256:c0a4335 (PR #3318)

Verdict

safe_to_merge

This is a same-tag digest bump from 6.1.1.10360-ls303 to 6.1.1.10360-ls304 — the Radarr application version is unchanged at 6.1.1.10360; the only change is a LinuxServer base image package version update. Both amd64 and arm64 architectures pass LinuxServer's own CI suite. No configuration, schema, or structural changes are present.


Blast radius

  • Scope: leaf_app
  • Direct usage: 1 manifest — rpi5/radarr/statefulset.yaml
  • Transitive dependents: 2
    • radarr-backup CronJob (rpi5/radarr/backup.yaml) — reads Radarr's /config PVC and calls the Radarr API via http://radarr; depends on Radarr being up and its API being reachable
    • oauth-proxy Deployment (rpi5/radarr/oauth.yaml) — fronts Radarr for all inbound traffic; not directly dependent on Radarr's image version
  • User-facing exposure:
    • Public hostnames affected: none (Tailscale ingress only: radarr via Tailscale; internal: radarr.local, radarr.internal)
    • Internal (oauth-gated) hostnames affected: radarr.local, radarr.internal (via radarr-auth oauth2-proxy), radarr (Tailscale)
    • Cron / scheduled jobs affected: radarr-backup (runs daily at 22:13)
  • Failure mode if upgrade goes wrong: hard_down — pod won't start or readiness probe at /ping:7878 fails; rolling update halts but old replica may still serve briefly
  • Recovery: trivial_rollback — pin old digest sha256:079e488..., redeploy; no stateful data is written by the image itself (SQLite DB on PVC is managed by Radarr application, not the base image)

Required actions before merge

None


Findings

F1: Digest-only bump — no application version change

  • Severity: informational
  • Category: image_structure
  • What changed: LinuxServer rebuilt the 6.1.1 tag as ls304 with updated Alpine package versions (one package bumped, per package_versions.txt diff). The Radarr application binary remains 6.1.1.10360.
  • Why it affects this deployment: The only change is OS-level package updates within the Alpine base image. No Radarr application code, config schema, probe paths, or environment variables changed.
  • Affected dependents: radarr StatefulSet only
  • Required action: no action — informational
  • Source: LinuxServer docker-radarr repository commit message "Bot Updating Package Versions"; LinuxServer release notes for 6.1.1.10360-ls304
  • Confidence: documented
  • Render-limited: no

F2: Architecture support — amd64 and arm64 both confirmed passing

  • Severity: informational
  • Category: architecture
  • What changed: N/A — same architectures as prior build
  • Why it affects this deployment: The cluster runs rpi5 nodes (arm64). LinuxServer's CI explicitly tests both AMD64 and ARM64 builds; both show PASS for 6.1.1.10360-ls304 (runtime 16.88s amd64, 77.18s arm64). The arm64 tag arm64v8-6.1.1.10360-ls304 is confirmed present and functional.
  • Affected dependents: radarr StatefulSet (runs on rpi5/arm64)
  • Required action: no action — informational
  • Source: LinuxServer CI test results for 6.1.1.10360-ls304
  • Confidence: documented
  • Render-limited: no

F3: Linkerd mesh injection — no known incompatibility

  • Severity: informational
  • Category: mesh
  • What changed: N/A
  • Why it affects this deployment: rpi5/radarr/statefulset.yaml has linkerd.io/inject: enabled annotation. The base image package bump does not affect Linkerd proxy injection compatibility; the proxy is injected by the control plane, not the application image.
  • Affected dependents: radarr StatefulSet
  • Required action: no action — informational
  • Source: rpi5/radarr/statefulset.yaml line 10
  • Confidence: inferred
  • Render-limited: no

F4: VPA present — resource limits may be adjusted dynamically

  • Severity: informational
  • Category: resources
  • What changed: N/A
  • Why it affects this deployment: rpi5/radarr/vpa.yaml exists, meaning the VPA operator may adjust resource requests/limits. A package-only rebuild is extremely unlikely to change memory footprint materially. Current limits: memory: 1Gi with requests: cpu: 250m, memory: 500Mi.
  • Affected dependents: radarr StatefulSet
  • Required action: no action — informational
  • Source: rpi5/radarr/vpa.yaml
  • Confidence: inferred
  • Render-limited: no

Deployment fingerprint (summary)

Surface Value
Image lscr.io/linuxserver/radarr:6.1.1 (StatefulSet, 1 replica)
Namespace inferred: same as other rpi5 apps (not explicitly set in manifest — uses default or kustomization namespace)
Env vars PUID=2011, PGID=3002, TZ=America/Los_Angeles
Volume mounts /config (PVC config-radarr-0, 5Gi RWO), /data (hostPath /data), /etc/ssl/certs/ca-certificates.crt (ConfigMap anshulg-ca)
Security context fsGroup: 3002 (pod-level); no container-level securityContext
Probes liveness + readiness: GET /ping:7878, initialDelay 30s
Resources requests: 250m CPU / 500Mi RAM; limits: 1Gi RAM (no CPU limit)
Service radarr ClusterIP port 80 → targetPort http (7878)
Ingress Traefik IngressRoute (radarr.local, radarr.internal) via radarr-auth:443; Tailscale Ingress (radarr)
Auth oauth2-proxy sidecar deployment (radarr-auth service)
Backup CronJob radarr-backup daily 22:13, reads PVC config-radarr-0, calls http://radarr API
Mesh Linkerd injected (linkerd.io/inject: enabled)
VPA Present (rpi5/radarr/vpa.yaml)

Cluster fit

  • Architectures required by cluster: amd64, arm64 (rpi5 nodes)
  • Architectures supported by new version: amd64 ✅, arm64 ✅ — confirmed by LinuxServer CI (amd64-6.1.1.10360-ls304 PASS, arm64v8-6.1.1.10360-ls304 PASS)
  • Kubernetes API versions used in manifest sources: apps/v1 (StatefulSet), v1 (Service, ConfigMap), batch/v1 (CronJob), traefik.io/v1alpha1 (IngressRoute, ServersTransport), networking.k8s.io/v1 (Ingress) — all current, none deprecated
  • Minimum K8s version stated by dep: not stated (LinuxServer images do not declare a minimum K8s version)
  • Peer dependency check: No chart dependencies; plain manifest deployment. Traefik IngressRoute and Tailscale Ingress are already in use by other apps in the cluster — no new ecosystem requirements introduced by this bump.

Gaps

  • The specific Alpine package that was bumped in package_versions.txt was not retrieved (the file diff was not fetched). However, given this is a routine weekly package refresh by LinuxServer CI and both architecture CI tests pass cleanly, the risk is negligible.
  • Namespace for the radarr deployment is not explicitly declared in the manifest files reviewed; it is likely set by a Kustomize overlay or ArgoCD Application not examined. This does not affect the impact assessment.
  • The rpi5/radarr/vpa.yaml content was not read in full; VPA mode (Off/Initial/Auto) is unknown, but this is irrelevant to the digest bump assessment.

Upstream changelog

I now have enough information to produce the complete research output. The key finding is that libxml2 2.13.9-r1 (Alpine edge) is the version in the new image, while 2.13.9-r0 was in the old image. The Alpine security tracker shows that 2.13.9-r0 in Alpine 3.23 is listed as "possibly vulnerable" to several CVEs (CVE-2025-49795, CVE-2025-49796), and the -r1 revision was built on Alpine edge on 2026-03-29 to address these. The image uses Alpine 3.23 (alpine-release 3.23.4-r0), and the -r1 package was pulled in from edge/main.


lscr.io/linuxserver/radarr 6.1.1 079e488 → c0a4335

Summary

  • Artifact type: Container image (LinuxServer.io Docker image on LSCR)
  • Input format: Image tag 6.1.1 with short-SHA digests (079e488c0a4335) — digest rotation on the same version tag
  • Resolved references: Both digests correspond to the same Radarr application version 6.1.1.10360. The old digest maps to LinuxServer release tag 6.1.1.10360-ls303 (commit cdb071c, 2026-05-17); the new digest maps to 6.1.1.10360-ls304 (commit 069832c, 2026-05-31). Source repo: github.com/linuxserver/docker-radarr
  • Versions in range: 6.1.1.10360-ls3036.1.1.10360-ls304 (one intermediate build, no pre-releases in the stable 6.1.1 track)
  • Source repo: LinuxServer docker-radarr repository
  • Primary sources used:
    • LinuxServer release notes for 6.1.1.10360-ls304
    • package_versions.txt diff between the two builds
    • Alpine Security Tracker: CVE-2025-49795 and CVE-2025-49796
  • Versioning scheme: LinuxServer custom — {radarr_version}-ls{build_number}. The 6.1.1 image tag is a floating tag that always points to the latest ls build for that Radarr version.
  • Major version boundary crossed: No
  • Confidence: medium — package diff is fully documented; the exact CVE fix scope of libxml2 2.13.9-r1 on Alpine 3.23 is partially inferred from Alpine Security Tracker data (the -r1 revision is listed as "possibly vulnerable" to CVE-2026-6732 on edge, but fixes CVE-2025-49795/49796 on Alpine 3.21/3.22/3.23)

Breaking Changes

None found. This is a digest rotation on the same Radarr application version. The Radarr application (6.1.1.10360), all .NET dependencies, and all other Alpine packages are identical between the two builds. No configuration, API, or behavioral changes.

Other Notable Changes

  • libxml2 bumped from 2.13.9-r0 to 2.13.9-r1 (Alpine apk): Security patch revision. Alpine 3.23 picked up the -r1 build (originally built for Alpine edge on 2026-03-29). The -r0 version is listed as "possibly vulnerable" to CVE-2025-49795 (NULL pointer dereference in XPath processing, DoS, HIGH) and CVE-2025-49796 (memory corruption via sch:name elements, DoS/undefined behavior, CRITICAL) on Alpine 3.23. The -r1 revision addresses these. Source: Alpine Security Tracker entries for CVE-2025-49795 and CVE-2025-49796

Deprecations Introduced

None found.

Gaps and Caveats

  • libxml2 2.13.9-r1 CVE fix scope on Alpine 3.23 is partially inferred: The Alpine Security Tracker shows 2.13.9-r0 on Alpine 3.23 as "possibly vulnerable" to CVE-2025-49795 and CVE-2025-49796, and the -r1 revision is the fix. However, the tracker's Alpine 3.23 entry for 2.13.9-r1 is not yet explicitly listed as "fixed" (only the edge branch shows -r1). The fix is inferred from the pattern across Alpine 3.21/3.22/3.23 branches. CVE-2026-6732 (type confusion in XSD validation, DoS) lists both -r0 and -r1 as "possibly vulnerable" on edge — this CVE may not be addressed by this update.
  • No migration guide exists at standard paths (UPGRADING.md, MIGRATING.md) — not applicable for a patch-level digest rotation.
  • The 6.1.1 image tag is floating — it will continue to be updated with future ls builds. Downstream consumers pinning by digest (as this PR does) are correctly isolated from future rotations.
  • LinuxServer release notes for ls304 state only "Updating to 6.1.1.10360" under Remote Changes and no LinuxServer-specific changes — confirming the only delta is the libxml2 package bump.

Provenance

RESEARCH_FAILED: provenance researcher could not complete.

Reason: Prompt error: CompletionError: ProviderError: {"error":{"message":"{\"type\":\"error\",\"error\":{\"type\":\"invalid_request_error\",\"message\":\"prompt is too long: 213031 tokens > 200000 maximum\"},\"request_id\":\"req_011CbbcYCKwhwCpYY9sqxeW2\"}. Received Model Group=claude-haiku-4-5\nAvailable Model Group Fallbacks=['claude-haiku-4-5-fallback']\nError doing the fallback: {\"type\":\"error\",\"error\":{\"type\":\"invalid_request_error\",\"message\":\"prompt is too long: 212887 tokens > 200000 maximum\"},\"request_id\":\"req_011CbbcYGRW4DranuHup97eC\"}"

The categorizer must treat this as an unverified signal and downgrade the verdict accordingly (do not assume safety).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants