From f9541b91a6bfea408ce6da097c6b2c74fb09da61 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 00:48:08 +0000
Subject: [PATCH 01/15] build(deps-dev): Bump globals from 17.13.0 to 17.14.0

Bumps [globals](https://github.com/sindresorhus/globals) from 17.13.0 to 17.14.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.13.0...v17.14.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f6f2f7668e..b357c68e7e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "@playwright/test": "^1.64.1",
         "eslint": "^10.14.0",
         "eslint-plugin-playwright": "^2.12.1",
-        "globals": "^17.13.0",
+        "globals": "^17.14.0",
         "stylelint": "^17.16.0"
       }
     },
@@ -1233,9 +1233,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.13.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
-      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
+      "version": "17.14.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.14.0.tgz",
+      "integrity": "sha512-UtdkTVyAJePQv0J2M9Xe4L0ruNSDV314XiIJsADI2Zf40bcdAonE/D/OhAU8AT99oij9mhLByb+NvA3QWZYgCg==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/package.json b/package.json
index 51b1424985..a27faa405f 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
     "@playwright/test": "^1.64.1",
     "eslint": "^10.14.0",
     "eslint-plugin-playwright": "^2.12.1",
-    "globals": "^17.13.0",
+    "globals": "^17.14.0",
     "stylelint": "^17.16.0"
   },
   "overrides": {

From 7983b79ee721ac15e04773bb3f8b13e87e09320a Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 5 Nov 2026 08:14:15 +0000
Subject: [PATCH 02/15] fix(svc-storage-nfs-server): pre-create the backup
 mount point in the shared state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every swarm node bind-mounts its node-local backup store over
/var/lib/infinito/backup, which lies inside the NFS-shared state. With the
mount point missing, ansible.posix.mount creates it on each node at the same
moment; it tolerates EEXIST only when isdir() confirms the path, and a stale
NFS lookup cache can deny that. PR #1376 run 41925742061 (Penpot#0 swarm)
failed so on swarm-wrk-01 with "Error making dir /var/lib/infinito/backup:
[Errno 17] File exists" while mgr-01 and wrk-02 succeeded.

The NFS server now creates the mount point in STORAGE_NFS_STATE_PATH right
after the state directory, as root:root 0755 like the mount module's own
mkdir, so no client has to create it. Existing hosts already have it with
that owner and mode.

| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 88 % | 2 % | – | – | ~100 % | 86 | ⛔ fix 88 % < 90 |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 roles/svc-storage-nfs-server/tasks/01_prepare.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/roles/svc-storage-nfs-server/tasks/01_prepare.yml b/roles/svc-storage-nfs-server/tasks/01_prepare.yml
index d265346729..5961e5ae11 100644
--- a/roles/svc-storage-nfs-server/tasks/01_prepare.yml
+++ b/roles/svc-storage-nfs-server/tasks/01_prepare.yml
@@ -18,6 +18,14 @@
     group: root
     mode: "0755"
 
+- name: "📁 Pre-create the {{ DIR_BACKUPS }} mount point in the shared state, so no two clients create it at once"
+  ansible.builtin.file:
+    path: "{{ [STORAGE_NFS_STATE_PATH, DIR_BACKUPS | relpath(DIR_VAR_LIB)] | path_join }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: "✅ Assert the state subdir is strictly nested under the export base"
   ansible.builtin.assert:
     that:

From bf1b1f2769cff463f409a368ad3497707c9cfb97 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 5 Nov 2026 09:43:37 +0000
Subject: [PATCH 03/15] fix(web-app-fider): pass BASE_URL without a trailing
 slash
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fider v0.39.0 accepts an OAuth redirect only when its origin equals
OAuthBaseURL (isKnownOAuthOrigin compares u.Scheme + "://" + u.Host with
it), and in single-host mode OAuthBaseURL is BASE_URL unchanged. The tls
lookup's url.base ends with "/", so the comparison never matched and
every Keycloak login was rejected. Main run 41925343136 (2df12002c0),
Fider#0 compose clearnet centos/ext4: playwright.spec.js:56 and :88 find
no .c-menu-user after SSO, and the rescue fider.log shows 11x "OAuth
callback state for provider _keycloak points at an unknown origin.
Aborting sign in process." The image is the mirrored getfider/fider
stable, refreshed 35 hours before the run.

The tls lookup now also returns url.origin, the base URL without its
slash (the lookup hunk of 44aaa68924 on feature/store-i18n), and the
Fider env passes it as BASE_URL (d531d35823 there). url.base keeps its
value, so no other consumer changes, and both lines match the
store-i18n side for a conflict-free merge.

| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 88 % | 3 % | – | – | ~100 % | 85 | ⛔ fix 88 % < 90 |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugins/lookup/tls.py                        |  5 +++--
 roles/web-app-fider/templates/env.j2         |  2 +-
 tests/unit/python/plugins/lookup/test_tls.py | 10 ++++++++++
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/plugins/lookup/tls.py b/plugins/lookup/tls.py
index 03de01439a..871986a7b0 100644
--- a/plugins/lookup/tls.py
+++ b/plugins/lookup/tls.py
@@ -99,7 +99,8 @@ class LookupModule(LookupBase):
         web_protocol = "https" if enabled else "http"
         websocket_protocol = "wss" if enabled else "ws"
         web_port = 443 if enabled else 80
-        base_url = f"{web_protocol}://{primary_domain}/"
+        origin = f"{web_protocol}://{primary_domain}"
+        base_url = f"{origin}/"
 
         resolved: dict[str, Any] = {
             "application_id": app_id,
@@ -109,7 +110,7 @@ class LookupModule(LookupBase):
             "domains": {"primary": primary_domain, "all": all_domains},
             "protocols": {"web": web_protocol, "websocket": websocket_protocol},
             "ports": {"web": web_port},
-            "url": {"base": base_url},
+            "url": {"base": base_url, "origin": origin},
         }
 
         if want:
diff --git a/roles/web-app-fider/templates/env.j2 b/roles/web-app-fider/templates/env.j2
index 30ebb09da2..38abb69ce7 100644
--- a/roles/web-app-fider/templates/env.j2
+++ b/roles/web-app-fider/templates/env.j2
@@ -1,6 +1,6 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
-BASE_URL={{ lookup('tls', application_id, 'url.base') }}
+BASE_URL={{ lookup('tls', application_id, 'url.origin') }}
 DATABASE_URL=postgresql://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}?sslmode=disable
 JWT_SECRET={{ (application_id ~ lookup('users', 'administrator').password) | hash('sha256') }}
 
diff --git a/tests/unit/python/plugins/lookup/test_tls.py b/tests/unit/python/plugins/lookup/test_tls.py
index af91c312e7..0cd80fcbb7 100644
--- a/tests/unit/python/plugins/lookup/test_tls.py
+++ b/tests/unit/python/plugins/lookup/test_tls.py
@@ -85,6 +85,16 @@ class TestTlsResolveLookup(unittest.TestCase):
         )[0]
         self.assertEqual(val, "https://a.example/")
 
+    def test_url_origin_is_the_base_url_without_its_trailing_slash(self):
+        origin, base = (
+            self.lookup.run(["web-app-a", want], variables=self.base_vars, mode="app")[
+                0
+            ]
+            for want in ("url.origin", "url.base")
+        )
+        self.assertEqual(origin, "https://a.example")
+        self.assertEqual(f"{origin}/", base)
+
     def test_protocols_web_path_is_http_for_an_onion_only_app(self):
         onion = dict(self.base_vars)
         onion["domains"] = {**self.domains, "web-app-onion": "abc123.onion"}

From 134afc16ba4635a9344593eedbb8519f1b5dc0fc Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 11:47:58 +0000
Subject: [PATCH 04/15] update(versions): update pins with a declared source
 (web-app-stalwart)

---
 roles/web-app-stalwart/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-stalwart/meta/services.yml b/roles/web-app-stalwart/meta/services.yml
index 710bb31351..0e2cd29530 100644
--- a/roles/web-app-stalwart/meta/services.yml
+++ b/roles/web-app-stalwart/meta/services.yml
@@ -42,7 +42,7 @@ stalwart:
   # nocheck: default-placement-manager  mail edge at a known IP: MX A-record, PTR and SPF bind to the stack host IP (a floating task's egress IP breaks deliverability); the mail store is NFS-hostile and IS the app — same rationale as web-app-mailu
   placement: manager
   image: stalwartlabs/stalwart
-  webui_version: "v2.0.4"
+  webui_version: "v2.0.5"
   version: "v1.0.3"
   update:
     key: webui_version

From 67b2add78a3746a74d5a0343d866b265462e8a74 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 5 Nov 2026 14:27:41 +0000
Subject: [PATCH 05/15] fix(svc-storage-nfs-server): fit the mount point task
 name and allow relpath
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

7983b79ee7 turned main red (run 42021812676, Test job): test-lint
rejects its task name (103 > 80 chars), and test-integration does not
know the relpath filter it uses. relpath is an ansible.builtin core
filter (ansible/plugins/filter/core.py), so it joins BUILTIN_FILTERS;
the task name drops its rationale, which the commit history keeps.

Both tests fail on main's files and pass with this change.

| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 97 % | 1 % | – | – | ~100 % | 96 | ⏳ score passes, gate.py not run (MAYDAY) |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 roles/svc-storage-nfs-server/tasks/01_prepare.yml | 2 +-
 tests/integration/ansible/filters/test_defined.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/roles/svc-storage-nfs-server/tasks/01_prepare.yml b/roles/svc-storage-nfs-server/tasks/01_prepare.yml
index 5961e5ae11..5cfa039600 100644
--- a/roles/svc-storage-nfs-server/tasks/01_prepare.yml
+++ b/roles/svc-storage-nfs-server/tasks/01_prepare.yml
@@ -18,7 +18,7 @@
     group: root
     mode: "0755"
 
-- name: "📁 Pre-create the {{ DIR_BACKUPS }} mount point in the shared state, so no two clients create it at once"
+- name: "📁 Pre-create the {{ DIR_BACKUPS }} mount point in the shared state"
   ansible.builtin.file:
     path: "{{ [STORAGE_NFS_STATE_PATH, DIR_BACKUPS | relpath(DIR_VAR_LIB)] | path_join }}"
     state: directory
diff --git a/tests/integration/ansible/filters/test_defined.py b/tests/integration/ansible/filters/test_defined.py
index cf8cd59d76..4ea402eaa4 100644
--- a/tests/integration/ansible/filters/test_defined.py
+++ b/tests/integration/ansible/filters/test_defined.py
@@ -90,6 +90,7 @@ BUILTIN_FILTERS: set[str] = {
     "items2dict",
     "password_hash",
     "path_join",
+    "relpath",
     "product",
     "quote",
     "split",

From d965f00041591ae5cc2e97b9f33a0d875416c077 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 5 Nov 2026 12:58:26 +0000
Subject: [PATCH 06/15] fix(build): keep nested agent worktrees out of the
 image build context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A quality gate in the main checkout ran compose-up and sent a 35.86 GB
build context, because .dockerignore did not exclude the agent
worktrees under .claude/worktrees/ (36 GB). Git ignores them through
the nested .claude/.gitignore, which the .dockerignore copy never sees.
The build cache grew from 28 to 86 GB until / was full.

.gitignore, and with it the generated .dockerignore, now lists
.claude/worktrees/ and .worktrees/. compose-up regenerates the
.dockerignore first, because its build path never ran
fix-dockerignore. The new lint pins the copy, both entries and the
compose-up prerequisite; on main it fails three times.

| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score |
| --- | --- | --- | --- | --- | --- |
| 95 % | 2 % | – | – | ~100 % | 93 |

```
/home/kevinveenbirkenbach/.local/share/worktrees/github.com/infinito-nexus/core/fix/dockerignore-agent-worktrees
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .dockerignore                              |  2 ++
 .gitignore                                 |  2 ++
 Makefile                                   |  2 +-
 tests/lint/repository/test_dockerignore.py | 31 ++++++++++++++++++++++
 4 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 tests/lint/repository/test_dockerignore.py

diff --git a/.dockerignore b/.dockerignore
index d2098ebad7..5cbbce7aee 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -20,6 +20,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env
diff --git a/.gitignore b/.gitignore
index d2098ebad7..5cbbce7aee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env
diff --git a/Makefile b/Makefile
index e08a2a1888..b400a0d679 100644
--- a/Makefile
+++ b/Makefile
@@ -260,7 +260,7 @@ compose-system-purge: compose-entity-purge
 
 .PHONY: compose-up
 # Start the development stack.
-compose-up: install
+compose-up: install fix-dockerignore
 	@"$${PYTHON}" -m cli.administration.deploy.development up
 
 .PHONY: console
diff --git a/tests/lint/repository/test_dockerignore.py b/tests/lint/repository/test_dockerignore.py
new file mode 100644
index 0000000000..81df725641
--- /dev/null
+++ b/tests/lint/repository/test_dockerignore.py
@@ -0,0 +1,31 @@
+import re
+import unittest
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parents[3]
+NESTED_CHECKOUTS = (".claude/worktrees/", ".worktrees/")
+
+
+class TestDockerignore(unittest.TestCase):
+    def test_dockerignore_is_the_gitignore(self) -> None:
+        self.assertEqual(
+            (PROJECT_ROOT / ".gitignore").read_text(),
+            (PROJECT_ROOT / ".dockerignore").read_text(),
+            "Run 'make fix-dockerignore': .dockerignore must be a copy of .gitignore.",
+        )
+
+    def test_nested_checkouts_stay_out_of_the_build_context(self) -> None:
+        lines = (PROJECT_ROOT / ".dockerignore").read_text().splitlines()
+        for entry in NESTED_CHECKOUTS:
+            with self.subTest(entry=entry):
+                self.assertIn(entry, lines)
+
+    def test_compose_up_regenerates_the_dockerignore(self) -> None:
+        makefile = (PROJECT_ROOT / "Makefile").read_text()
+        match = re.search(r"^compose-up:(.*)$", makefile, re.MULTILINE)
+        self.assertIsNotNone(match, "Makefile has no compose-up target")
+        self.assertIn("fix-dockerignore", match.group(1).split())
+
+
+if __name__ == "__main__":
+    unittest.main()

From 739f81cca0d78498af25a9798e5b65afc94ea760 Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:36:25 +0000
Subject: [PATCH 07/15] update(images): update Docker image versions
 (web-app-keycloak)

---
 roles/web-app-keycloak/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-keycloak/meta/services.yml b/roles/web-app-keycloak/meta/services.yml
index 86d2f2f0af..adf9a3f072 100644
--- a/roles/web-app-keycloak/meta/services.yml
+++ b/roles/web-app-keycloak/meta/services.yml
@@ -91,7 +91,7 @@ keycloak:
 # nocheck: playwright-service-flag — sidecar shape, no probe-able surface flag
 sso_proxy:
   image: quay.io/oauth2-proxy/oauth2-proxy
-  version: "v7.15.5"
+  version: "v7.15.6"
   min_storage: 220MB
   configuration_file: oauth2-proxy-keycloak.cfg
   ports:

From 6a53cd0f3430d34f48d84041abf26c8246dbba6e Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:36:31 +0000
Subject: [PATCH 08/15] update(images): update Docker image versions
 (web-app-mattermost)

---
 roles/web-app-mattermost/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-mattermost/meta/services.yml b/roles/web-app-mattermost/meta/services.yml
index fd3b6ef275..e7b08833e8 100644
--- a/roles/web-app-mattermost/meta/services.yml
+++ b/roles/web-app-mattermost/meta/services.yml
@@ -46,7 +46,7 @@ mattermost:
   shared: true
   user_access_token_enabled: "{{ 'web-app-nextcloud' in group_names }}"
   image: mattermost/mattermost-team-edition
-  version: 12.0.2
+  version: 12.1.0
   min_storage: 659MB
   backup:
     no_stop_required: true

From 8675cf84828b45481c12238e16c1ce055e8fde92 Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:36:36 +0000
Subject: [PATCH 09/15] update(images): update Docker image versions
 (web-app-nextcloud)

---
 roles/web-app-nextcloud/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-nextcloud/meta/services.yml b/roles/web-app-nextcloud/meta/services.yml
index eabc21d99a..ac9c5c55ec 100644
--- a/roles/web-app-nextcloud/meta/services.yml
+++ b/roles/web-app-nextcloud/meta/services.yml
@@ -141,7 +141,7 @@ context_agent:
   shared: "{{ lookup('config', 'web-app-nextcloud', 'mcp.enabled') | bool }}"
   name: nextcloud-context-agent
   image: ghcr.io/nextcloud/context_agent
-  version: 2.10.0
+  version: 2.11.0
   backup:
     no_stop_required: true
   # nocheck: single-replica

From 149e5b7af2a421dc89bd24e23ae5e540f0e1bc73 Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:36:58 +0000
Subject: [PATCH 10/15] update(versions): update pins with a declared source
 (web-app-moodle)

---
 roles/web-app-moodle/meta/addons/auth_oidc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-moodle/meta/addons/auth_oidc.yml b/roles/web-app-moodle/meta/addons/auth_oidc.yml
index 5d68112121..88b4da3c08 100644
--- a/roles/web-app-moodle/meta/addons/auth_oidc.yml
+++ b/roles/web-app-moodle/meta/addons/auth_oidc.yml
@@ -3,7 +3,7 @@ enabled: "{{ lookup('config', 'web-app-moodle', 'services.sso.enabled') | bool }
 required: false
 mechanism: plugin
 source: upstream
-version: "v5.2.1"
+version: "v5.3.0"
 bridges:
   - sso
 update:

From 6b3e33e211d3ce246feaaf2bd23d3e3bfb2335ea Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:37:05 +0000
Subject: [PATCH 11/15] update(versions): update pins with a declared source
 (web-app-xwiki)

---
 roles/web-app-xwiki/meta/addons/oidc-authenticator.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-xwiki/meta/addons/oidc-authenticator.yml b/roles/web-app-xwiki/meta/addons/oidc-authenticator.yml
index dcd823c54c..c4c0021e48 100644
--- a/roles/web-app-xwiki/meta/addons/oidc-authenticator.yml
+++ b/roles/web-app-xwiki/meta/addons/oidc-authenticator.yml
@@ -5,7 +5,7 @@ mechanism: extension
 source: upstream
 bridges:
   - sso
-version: "2.29.1"
+version: "2.30.0"
 update:
   type: http_regex
   url: https://maven.xwiki.org/releases/org/xwiki/contrib/oidc/oidc-authenticator/maven-metadata.xml

From 13bdb25f1f10c9b2f760579bff1f9f277c40c82a Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:46:40 +0000
Subject: [PATCH 12/15] update(images): update Docker image versions
 (web-app-prometheus)

---
 roles/web-app-prometheus/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-prometheus/meta/services.yml b/roles/web-app-prometheus/meta/services.yml
index 3efbe50131..6b514e2828 100644
--- a/roles/web-app-prometheus/meta/services.yml
+++ b/roles/web-app-prometheus/meta/services.yml
@@ -55,7 +55,7 @@ prometheus:
   provides:
     - prometheus
   image: prom/prometheus # nocheck: volumes-path-single-spot: the repository path of an image name, not a mount target
-  version: v3.15.1
+  version: v3.16.0
   name: prometheus
   cpus: "0.5"
   mem_reservation: 512m

From 05869bbe431ae243228d7da57b38382cf67e9004 Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:46:45 +0000
Subject: [PATCH 13/15] update(images): update Docker image versions
 (web-app-wazuh)

---
 roles/web-app-wazuh/meta/services.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/web-app-wazuh/meta/services.yml b/roles/web-app-wazuh/meta/services.yml
index 224974902e..a3ed60f9e1 100644
--- a/roles/web-app-wazuh/meta/services.yml
+++ b/roles/web-app-wazuh/meta/services.yml
@@ -68,7 +68,7 @@ certs_generator:
   pids_limit: 128
 manager:
   image: wazuh/wazuh-manager
-  version: "4.14.9"
+  version: "4.14.10"
   name: wazuh.manager
   # nocheck: min-storage-headroom  Reason: budgets room for wazuh-manager's own operational data (var-ossec logs, alerts, agent queue/state) to grow well beyond the base image over the service's lifetime, not just the image itself.
   min_storage: 10GB
@@ -98,7 +98,7 @@ indexer:
     # nocheck: healthcheck-timing-override  covers the indexer's real boot without waiting out the curl flavor's 10m default, which would otherwise stall manager/dashboard's startup order far longer than the indexer actually needs.
     start_period: 90s
   image: wazuh/wazuh-indexer
-  version: "4.14.9"
+  version: "4.14.10"
   name: wazuh.indexer
   # nocheck: min-storage-headroom  Reason: budgets room for the OpenSearch index data (security events/alerts Wazuh continuously ingests) to grow well beyond the base image over the service's lifetime, not just the image itself.
   min_storage: 20GB
@@ -116,7 +116,7 @@ indexer:
       http: 8097
 console:
   image: wazuh/wazuh-dashboard
-  version: "4.14.9"
+  version: "4.14.10"
   name: wazuh.dashboard
   # nocheck: min-storage-headroom  Reason: budgets room for the dashboard's own runtime state (OpenSearch Dashboards bundle/build cache rebuilt on first boot, plus exported reports and saved-object data) to grow beyond the base image, not just the image itself.
   min_storage: 2GB

From 8ce4934dabd66d77282d69bf276fbf42fb160ce6 Mon Sep 17 00:00:00 2001
From: "infinito-nexus-updater[bot]"
 <286144613+infinito-nexus-updater[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 16:28:01 +0000
Subject: [PATCH 14/15] update(images): update Docker image versions
 (web-app-keycloak)

---
 roles/web-app-keycloak/meta/services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/web-app-keycloak/meta/services.yml b/roles/web-app-keycloak/meta/services.yml
index adf9a3f072..e4ad93e494 100644
--- a/roles/web-app-keycloak/meta/services.yml
+++ b/roles/web-app-keycloak/meta/services.yml
@@ -51,7 +51,7 @@ keycloak:
   shared: true
   provides: sso
   image: quay.io/keycloak/keycloak
-  version: "26.8.1"
+  version: "26.8.2"
   name: keycloak
   min_storage: 468MB
   cpus: "2.0"

From 5caa064345d92334eb14ffd6edb7f9e01df8eb3d Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 5 Nov 2026 16:45:50 +0000
Subject: [PATCH 15/15] fix(tests): make the dockerignore lint follow the
 repository lints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tests/lint/repository/test_dockerignore.py from #1384 computes its own
PROJECT_ROOT through parents[3] and reads files with Path.read_text, so
test_project_root_import and test_no_uncached_file_reads fail on main
(found by the store-i18n quality gate after its main merge). It now
imports PROJECT_ROOT from the package and reads through
utils.cache.files.read_text, like its neighbours; its three checks are
unchanged.

Both lints fail with main's version of the file and pass with this
one; the test itself still passes.

| 🎯 Fix | 💥 Break | 💸 Cost | ⏱️ Time | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 95 % | 1 % | – | – | ~100 % | 94 | ⏳ score passes, gate.py not run (store-i18n gate holds the slot) |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/lint/repository/test_dockerignore.py | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/tests/lint/repository/test_dockerignore.py b/tests/lint/repository/test_dockerignore.py
index 81df725641..c900866f99 100644
--- a/tests/lint/repository/test_dockerignore.py
+++ b/tests/lint/repository/test_dockerignore.py
@@ -1,27 +1,29 @@
 import re
 import unittest
-from pathlib import Path
 
-PROJECT_ROOT = Path(__file__).resolve().parents[3]
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
 NESTED_CHECKOUTS = (".claude/worktrees/", ".worktrees/")
 
 
 class TestDockerignore(unittest.TestCase):
     def test_dockerignore_is_the_gitignore(self) -> None:
         self.assertEqual(
-            (PROJECT_ROOT / ".gitignore").read_text(),
-            (PROJECT_ROOT / ".dockerignore").read_text(),
+            read_text(str(PROJECT_ROOT / ".gitignore")),
+            read_text(str(PROJECT_ROOT / ".dockerignore")),
             "Run 'make fix-dockerignore': .dockerignore must be a copy of .gitignore.",
         )
 
     def test_nested_checkouts_stay_out_of_the_build_context(self) -> None:
-        lines = (PROJECT_ROOT / ".dockerignore").read_text().splitlines()
+        lines = read_text(str(PROJECT_ROOT / ".dockerignore")).splitlines()
         for entry in NESTED_CHECKOUTS:
             with self.subTest(entry=entry):
                 self.assertIn(entry, lines)
 
     def test_compose_up_regenerates_the_dockerignore(self) -> None:
-        makefile = (PROJECT_ROOT / "Makefile").read_text()
+        makefile = read_text(str(PROJECT_ROOT / "Makefile"))
         match = re.search(r"^compose-up:(.*)$", makefile, re.MULTILINE)
         self.assertIsNotNone(match, "Makefile has no compose-up target")
         self.assertIn("fix-dockerignore", match.group(1).split())