Update ttlequals0/minuspod Docker tag to v2.8.10

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
ttlequals0/minuspod	minor	2.7.7 → 2.8.10	2.25.2 (+38)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 12am and before 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

ttlequals0/minuspod (docker) 2.7.7 -> 2.8.10

Risk: 🟢 Safe

The Deep Dive

Update Scope

Updates the raw Kubernetes image for ttlequals0/minuspod in claytono/infra PR 2432 from 2.7.7@sha256:bb38785de00a03ac30fa2ac0710fa9d6a7f8d0d170cce4a8a6951b237a4897bc to 2.8.10@sha256:3b5779d87e4f86b9aa0a0e7e9fa4a87e90b7b71084c177ab6ab87fd620bde589. The deployed object is the GPU image, not the upstream -cpu image; Docker metadata for 2.7.7 and 2.8.10 reports the same linux/amd64 platform, /app/entrypoint.sh, port 8000/tcp, and CUDA 12.9.2 environment via Docker Hub tag metadata.

Performance & Stability

• MinusPod PR 357 makes the new Re-detect Ads mode transcription-free after pass 1 by mapping saved transcripts through applied cuts; because this deployment uses local CUDA Whisper, that reduces GPU transcription work for manual re-detection.
• MinusPod PR 357 also retries transient podcast media 404 downloads instead of permanently failing a just-published episode and serving 410 until manual reprocess.
• MinusPod PR 361 fixes cut/timestamp stability issues in the processing pipeline, including original-time pairing through validation, overlapping-cut timestamp adjustment, ffprobe duration clamping, and word-level transcript trimming.

Features & UX

• MinusPod PR 363 adds an Ad Distribution panel and GET /feeds/{slug}/ad-distribution; it is informational, collapsed by default, shows for every feed, and needs no manifest change.
• MinusPod PR 362 adds learned per-feed ad-position priors. This deployment manifest does not enable it, and upstream defaults positionalPriorEnabled to false in the settings API. To enable it after checking the distribution panel, use Settings -> Experiments -> Learned Ad Positions -> Enable learned ad positions, or PUT /api/v1/settings/ad-detection with { "positionalPriorEnabled": true }.
• MinusPod PR 357 adds spectral audio cue detection, which uses an extra ffmpeg pass to pass short non-spoken cue timing hints to the detector. This deployment manifest does not enable it, and upstream defaults audioCueDetectionEnabled and audioCueCreateFromPairs to false in the settings API. To enable the conservative cue-hint path, use Settings -> Experiments -> Audio Cue Detection -> Enable audio cue detection, or PUT /api/v1/settings/ad-detection with { "audioCueDetectionEnabled": true }; leave audioCueCreateFromPairs false unless you intentionally want cue pairs to synthesize reviewer-checked ad spans.

Security

• MinusPod PR 357 caps response bodies read by the OpenRouter, pricepertoken, and LiteLLM pricing fetchers; because this deployment sets LLM_PROVIDER=openrouter, that closes a configured worker memory-exhaustion path.
• I found no MinusPod repository advisory in GitHub Security Advisories and no PR-introduced CVE. GHSA-537c-gmf6-5ccf affects cryptography < 48.0.1, but cryptography 48.0.0 entered MinusPod in the 2.1.7 changelog entry, before this PR's 2.7.7 baseline, so it is pre-existing and does not change this PR's risk.

Key Fixes

• MinusPod PR 357 retries empty LLM completions instead of treating them as a clean no-ad result; that is relevant because this deployment uses OpenRouter for LLM calls.
• MinusPod PR 357 escapes ]]> in upstream podcast descriptions so generated RSS CDATA stays well-formed for subscribers.
• MinusPod PR 357 fixes single-feed Force Refresh so it bypasses the 30-second coalesce window when explicitly requested.
• MinusPod PR 361 fixes several processed-audio and transcript correctness bugs that affect the persistent /app/data pipeline used by this deployment.

Newer Versions

• Docker Hub shows newer tags through 2.25.2, beyond this PR's 2.8.10.
• I found no later MinusPod changelog item or advisory fixing a regression or vulnerability introduced by the 2.7.7 -> 2.8.10 range. The notable newer security item is the 2.8.12 changelog entry, which fixes GHSA-537c-gmf6-5ccf, but that vulnerable cryptography 48.0.0 dependency came from the 2.1.7 changelog entry and is not introduced by this PR.

Hazards & Risks

None identified. MinusPod PR 362 learned positions and MinusPod PR 357 audio cue detection are opt-in/off by default, MinusPod docs state the audio-cue controls are UI/API DB settings with no env variable, and Docker Hub tag metadata shows the same platform, entrypoint, port, and CUDA base contract as 2.7.7.

Sources

• claytono/infra PR 2432
• Proposed minuspod deployment manifest
• MinusPod Docker Hub tags
• MinusPod changelog
• MinusPod PR 357
• MinusPod PR 361
• MinusPod PR 362
• MinusPod PR 363
• GitHub Advisory GHSA-537c-gmf6-5ccf
• MinusPod audio cue configuration docs

---

🟢 Verdict: Safe

claytono/infra PR 2432 is renovate:safe: the deployed image advances to 2.8.10 with the same container contract, configured OpenRouter/local-CUDA paths receive fixes, and I found no introduced CVE, migration, or default-on behavior change requiring targeted validation beyond the repo's normal Kubernetes rollout.