chore(deps): update ghcr.io/pi-hole/pihole docker tag to v2026 by madic-creates · Pull Request #160 · madic-creates/k3s-git-ops

madic-creates · 2026-05-09T14:54:54Z

This PR contains the following updates:

Package	Update	Change
ghcr.io/pi-hole/pihole	major	`2025.11.1` → `2026.07.2`

Release Notes

pi-hole/docker-pi-hole (ghcr.io/pi-hole/pihole)

`v2026.07.2`

Compare Source

Missing commit from previous release which is the docker-equivalent of the fix for pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww

Move logrotate file to /etc/logrotate.d/pihole 14b661a by @yubiuser

Full Changelog: pi-hole/docker-pi-hole@2026.07.1...2026.07.2

`v2026.07.1`

Compare Source

What's Changed

Restore --no-cache flag for apk by @casperklein in #2056

Full Changelog: pi-hole/docker-pi-hole@2026.07.0...2026.07.1

`v2026.07.0`

Compare Source

What's Changed (Docker Specific)

Add ShellCheck CI and fix reported issues by @lightswitch05 in #2039
Make crond and cron job output visible in "docker log" by @casperklein in #2035
feat: optimize Docker build caching by @lightswitch05 in #2038
remove buildkit cache mount from apk add layer by @PromoFaux in #2049

Full Changelog: pi-hole/docker-pi-hole@2026.04.1...2026.07.0

Security Fixes

pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww — Local privilege escalation from pihole user to root via /etc/pihole/logrotate (High) reported by supperhellokitty20
pi-hole/FTL/security/advisories/GHSA-q6fm-xwxf-37r5 — WebUI (& API) DoS via lack of rate limiting (High) reported by rrobgill
pi-hole/FTL/security/advisories/GHSA-w8cr-2cwg-92cg — Session expiration bypass (High) reported by T0X1Cx
pi-hole/FTL/security/advisories/GHSA-8j7w-m3cr-6q6x — Remote Code Execution via CivetWeb configuration injection (High) reported by SakusenSec
pi-hole/FTL/security/advisories/GHSA-g7v8-8q8f-hprp — Log injection in the access-log writer chaining to RCE via Lua-server-page evaluation (Moderate)
pi-hole/FTL/security/advisories/GHSA-r5vh-5q82-jg7q — CRLF injection / HTTP header injection via group name (Low) reported by T0X1Cx

What's Changed (FTL v6.7)

Performance optimizations and bug fixes by @DL6ER in pi-hole/FTL#2816
fix: check NULL returns from strdup/calloc in rotate_files() by @jluzzi123 in pi-hole/FTL#2875
Make error messages more human friendly by @yubiuser in pi-hole/FTL#2878
Harden API/database races in civetweb and DB threads by @DL6ER in pi-hole/FTL#2881
Update embedded SQLite3 to v3.53.1 by @DL6ER in pi-hole/FTL#2891
Fix build on Fedora 44 by @darkexplosiveqwx in pi-hole/FTL#2893
macvendor: resolve sub-allocated blocks (MA-M/MA-S) via longest-prefix match by @RamSet in pi-hole/FTL#2907
Update embedded dnsmasq to v2.93 by @DL6ER in pi-hole/FTL#2890
fix OOB write in FTL_parse_pseudoheaders when optlen is 0 by @rdevshp in pi-hole/FTL#2910
Update a single text description "PRIVATE KEY" by @DoctorD90 in pi-hole/FTL#2884
add optional dnsmasq features to cmake by @darkexplosiveqwx in pi-hole/FTL#2874
Fix building on alpine 3.24 by @yubiuser in pi-hole/FTL#2911
Bats by @yubiuser in pi-hole/FTL#2872
Improve crash backtraces for non-reproducible faults by @DL6ER in pi-hole/FTL#2880
Fix gzip.c inflate_buffer CRC signed left shift undefined behavior by @rdevshp in pi-hole/FTL#2916
Fix for iCloud Private Relay zones by @DL6ER in pi-hole/FTL#2919
fix tar parsing by @rdevshp in pi-hole/FTL#2914
Allow using local manufs to generate macvendor.db by @darkexplosiveqwx in pi-hole/FTL#2918
Use custom message for UNIQUE constraint error message by @rdwebdesign in pi-hole/FTL#2879
Re-resolve client groups event-driven, drop periodic recheck by @DL6ER in pi-hole/FTL#2922
Guard against invalid gzip data in gzip.c inflate_buffer by @rdevshp in pi-hole/FTL#2915
Fix BATS test of no ERRORS in FTL.log to allow capturing the output by @yubiuser in pi-hole/FTL#2927
fix(cli): warn when --config cannot read pihole.toml (#2849) by @DL6ER in pi-hole/FTL#2930
fix(api-docs): correct three OpenAPI spec issues (#2867) by @DL6ER in pi-hole/FTL#2929
fix: avoid segfault in dnsmasq-test on unreadable config file by @DL6ER in pi-hole/FTL#2928
Fix prefix-match bug and improve fallthrough logging in redirect_root_handler by @slmingol in pi-hole/FTL#2933
Swap misaligned comments for domain-needed and expand-hosts. by @0xpsyduck in pi-hole/FTL#2932
Code review July 2026 by @DL6ER in pi-hole/FTL#2935
Pi-hole FTL v6.7 by @PromoFaux in pi-hole/FTL#2936

New Contributors

@jluzzi123 made their first contribution in pi-hole/FTL#2875
@RamSet made their first contribution in pi-hole/FTL#2907
@rdevshp made their first contribution in pi-hole/FTL#2910
@DoctorD90 made their first contribution in pi-hole/FTL#2884
@slmingol made their first contribution in pi-hole/FTL#2933
@0xpsyduck made their first contribution in pi-hole/FTL#2932

Full Changelog: pi-hole/FTL@v6.6.2...v6.7

What's Changed (Core v6.4.3)

Also hardcode the PID file location in utils.sh to prevent readonly variable warning by @PromoFaux in pi-hole/pi-hole#6613
Use awk to compare curl versions by @rdwebdesign in pi-hole/pi-hole#6621
Explicitly add gawk to APK dependencies by @yubiuser in pi-hole/pi-hole#6622
Prevent double error message output in gravity run with invalid file by @PromoFaux in pi-hole/pi-hole#6607
Replace pytest/tox with direct in-container BATS by @PromoFaux in pi-hole/pi-hole#6598
Add Fedora 44 and Ubuntu 26.04 LTS to tests by @darkexplosiveqwx in pi-hole/pi-hole#6623
Add gravity tests by @yubiuser in pi-hole/pi-hole#6639
Set BATS pretty output flag depending on the terminal and improve failure output by @yubiuser in pi-hole/pi-hole#6644
fix: check return codes in gravity_build_tree and database_recovery() by @jluzzi123 in pi-hole/pi-hole#6630
Include alpine 3.24 in tests by @yubiuser in pi-hole/pi-hole#6654
installer: fix custom DNS entry when only one upstream server is provided by @Gilmoursa in pi-hole/pi-hole#6638
Fix BATS gravity test on curl version >=8.21 by @yubiuser in pi-hole/pi-hole#6661
avoid copytruncate in logrotate by @darkexplosiveqwx in pi-hole/pi-hole#6642

New Contributors

@jluzzi123 made their first contribution in pi-hole/pi-hole#6630
@Gilmoursa made their first contribution in pi-hole/pi-hole#6638

Full Changelog: pi-hole/pi-hole@v6.4.2...v6.4.3

What's Changed (Web v6.6)

Improve DHCP static leases interface (alternative) by @rdwebdesign in pi-hole/web#3766
Lists page - Improve hints and help text by @rdwebdesign in pi-hole/web#3798
Update daterangepicker ranges everytime the picker is shown by @yubiuser in pi-hole/web#3793
Better user interface to edit reverse DNS servers (dns.revServers) by @rdwebdesign in pi-hole/web#3769

Full Changelog: pi-hole/web@v6.5.1...v6.6

`v2026.06.0`

Compare Source

What's Changed (Docker Specific)

docs: update capability documentation links by @SirRGB in #2025

New Contributors

@SirRGB made their first contribution in #2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.06.0

What's Changed (Web 6.5.1)

Fix backed-up typo by @yubiuser in pi-hole/web#3759
fix: replace ES2024 regex v flag with u for WebKit compatibility by @Gilmoursa in pi-hole/web#3778
bug: multiline comments on doughnut chart by @vinaykulk621 in pi-hole/web#3781

New Contributors

@Gilmoursa made their first contribution in pi-hole/web#3778
@vinaykulk621 made their first contribution in pi-hole/web#3781

Full Changelog: pi-hole/web@v6.5...v6.5.1

`v2026.05.0`

Compare Source

This tag includes the FTL v6.6.2 release which imports six upstream dnsmasq security fixes, covering all publicly disclosed CVEs against the dnsmasq 2.92/2.93 line. Patches are taken verbatim from https://thekelleys.org.uk/dnsmasq/CVE/

Details here: https://github.com/pi-hole/FTL/releases/tag/v6.6.2

Upgrade impact

All six fixes are minimal, self-contained changes to the embedded dnsmasq sources. No FTL-side configuration or API changes; users should see no observable behavior change beyond the closed vulnerabilities.

Fix dnsmasq CVE publications by @DL6ER in pi-hole/FTL#2888

This furthermore indirectly fixes #2871 due to pi-hole/docker-base-images#158

Full Changelog: pi-hole/FTL@v6.6.1...v6.6.2

What's Changed (Docker Specific)

docs: update capability documentation links by @SirRGB in #2025

New Contributors

@SirRGB made their first contribution in #2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.05.0

`v2026.04.1`

Compare Source

What's Changed

docs: update capability documentation links by @SirRGB in #2025

New Contributors

@SirRGB made their first contribution in #2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.04.1

New component versions included in this tag:

What's Changed (FTL v6.6.1)

Add new GET /api/config/_properties endpoint by @DL6ER in pi-hole/FTL#2356
Fix thread-safety issues causing SIGSEGV under concurrent API load by @DL6ER in pi-hole/FTL#2835
fix: fix rare race condition for SHM strings in API handlers by @DL6ER in pi-hole/FTL#2833
Accept punycode domains that libidn2 rejects under IDNA2008 by @DL6ER in pi-hole/FTL#2838
Improve shutdown diagnostics to identify SIGTERM source by @DL6ER in pi-hole/FTL#2839
Resolve empty backtraces when addr2line is not installed by @DL6ER in pi-hole/FTL#2831
Improve thread-safety for concurrent API requests by @DL6ER in pi-hole/FTL#2847
Don't skip device lookup when resolver.macNames is disabled by @DL6ER in pi-hole/FTL#2846
Fix linker error when compiling w/o optimization by @aeolio in pi-hole/FTL#2850
Clarify dns.blockESNI wording by @darkexplosiveqwx in pi-hole/FTL#2784
Preserve log file path config when fopen fails by @DL6ER in pi-hole/FTL#2834

Security advisories

GHSA-6w8x-p785-6pm4
- Fixed with : pi-hole/FTL@88c569a and pi-hole/pi-hole@7ccb8dd
GHSA-9cqv-839p-gpq2
- Fixed with : pi-hole/FTL@0c46e4e

New Contributors

@darkexplosiveqwx made their first contribution in pi-hole/FTL#2784

Full Changelog: pi-hole/FTL@v6.6...v6.6.1

What's Changed (Core v6.4.2)

Wipe version file before creating a new one by @yubiuser in pi-hole/pi-hole#6538
Fix ownership permissions for containing directories in fix_owner_per… by @PromoFaux in pi-hole/pi-hole#6589
Remove reference to /usr/local/bin/COL_TABLE by @darkexplosiveqwx in pi-hole/pi-hole#6594
Skip apt cache update when pihole-meta is current by @PromoFaux in pi-hole/pi-hole#6581
Set versions in /etc/pihole/versions to null if script fails by @yubiuser in pi-hole/pi-hole#6550
Remove redundant touching of logfiles from systemd Service by @yubiuser in pi-hole/pi-hole#6601
Loosen requirements for local file access for gravity by @yubiuser in pi-hole/pi-hole#6430
Fix permission for *.etag files after gravity run by @yubiuser in pi-hole/pi-hole#6353
add logrotate to DEB and RPM dependencies by @darkexplosiveqwx in pi-hole/pi-hole#6524
Improve gravity error message including curl exit code and errormsg by @rdwebdesign in pi-hole/pi-hole#6605

Security advisories

GHSA-6w8x-p785-6pm4
- Fixed with : pi-hole/pi-hole@7ccb8dd and pi-hole/FTL@88c569a

Full Changelog: pi-hole/pi-hole@v6.4.1...v6.4.2

`v2026.04.0`

Compare Source

What's Changed (Docker Specific - all related to CI/build)

Group dependabot PRs to reduce PR spam by @yubiuser in #2004
ci: switch image publishing to docker/github-builder by @crazy-max in #2008
Readme Rework by @PromoFaux in #1958
Replace Python test suite with BATS and consolidate workflows by @PromoFaux in #2009
Add timeout to curl command in branch validation by @RynoCODE in #2011
Use bats-assert library functions in BATS test suite by @Copilot in #2018
ci: run build job on pull request event by @crazy-max in #2021
Update github-builder to v1.5.0 and enable fail-fast by @yubiuser in #2022

New Contributors

@crazy-max made their first contribution in #2008
@RynoCODE made their first contribution in #2011
@Copilot made their first contribution in #2018

Full Changelog: pi-hole/docker-pi-hole@2026.02.0...2026.04.0

Component Release Notes

What's Changed (FTL v6.6)

Fix possible resolver issue on armv5tel by @DL6ER in pi-hole/FTL#2781
Introduce CMake options for optional dependencies by @aeolio in pi-hole/FTL#2795
Fix build without mbedtls [v2] by @aeolio in pi-hole/FTL#2796
Fix overTime data when database.DBimport = false by @DL6ER in pi-hole/FTL#2788
Fix cross-compilation issues w/ custom toolchain by @aeolio in pi-hole/FTL#2797
Add new option for controling name resolution via MAC address by @DL6ER in pi-hole/FTL#2790
Fix obtaining client groups by name by @DL6ER in pi-hole/FTL#2791
Ensure API sessions are restored before starting the HTTP server by @DL6ER in pi-hole/FTL#2803
Add form-action 'self' to Content-Security-Policy by @yubiuser in pi-hole/FTL#2804
Add query_frequency to /padd endpoint by @yubiuser in pi-hole/FTL#2806
Guard query-count counters against unsigned underflow by @DL6ER in pi-hole/FTL#2815
Add universal crash backtrace via _Unwind_Backtrace by @DL6ER in pi-hole/FTL#2811
config: show totp_secret presence in CLI output by @DL6ER in pi-hole/FTL#2813
Fix client count inflation for rate-limited queries by @DL6ER in pi-hole/FTL#2814
Fix stack buffer overflow in get_process_name() by @DL6ER in pi-hole/FTL#2821
Do not restart FTL while pihole -g is still ongoing by @DL6ER in pi-hole/FTL#2419

Security Advisories

GHSA-r7g8-3fj7-m5qq - Authorization bypass: CLI API sessions can import Teleporter archives and modify configuration reported by @mzalzahrani
Remote Code Execution (RCE) via Newline Injection in Multiple Configuration Parameters reported by @T0X1Cx

New Contributors

@aeolio made their first contribution in pi-hole/FTL#2795

Full Changelog: pi-hole/FTL@v6.5...v6.6

What's Changed (Web v6.5)

Amend teleporter help text that the long-term data is not included by @yubiuser in pi-hole/web#3721
Do not use 3 columns when boxed layout is used by @rdwebdesign in pi-hole/web#3722
Use ENTER instead of ⏎ by @yubiuser in pi-hole/web#3727
Don't link to github releases if docker tag is nightly by @yubiuser in pi-hole/web#3718
Do not try to compare component version when remote version info is not available by @yubiuser in pi-hole/web#3729
Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @yubiuser in pi-hole/web#3742
fix: check on responseJSON when wrong password by @guybrush2105 in pi-hole/web#3693
Remove the loggingButton from Settings > System > Actions by @yubiuser in pi-hole/web#3747

Security Advisories

Multiple Stored HTML Injections and XSS in different web interface pages reported by @andrejtomci

New Contributors

@guybrush2105 made their first contribution in pi-hole/web#3693

Full Changelog: pi-hole/web@v6.4.1...v6.5

What's Changed (Core v6.4.1)

Remove additional ':' from debug log system time output by @yubiuser in pi-hole/pi-hole#6551
Remove readonly from piholeNetworkFlush.sh to avoid error message by @rdwebdesign in pi-hole/pi-hole#6554
Add antigravity index by @DL6ER in pi-hole/pi-hole#6573
Fix return status capture of FTL check_download exists by @yubiuser in pi-hole/pi-hole#6572
Remove misleading TODO comment for SetWebPassword by @10adnan75 in pi-hole/pi-hole#6531

Security Advisories

GHSA-c935-8g63-qp74 – Local Privilege Escalation reported by @smittix

New Contributors

@10adnan75 made their first contribution in pi-hole/pi-hole#6531
@Copilot made their first contribution in pi-hole/pi-hole#6580

Full Changelog: pi-hole/pi-hole@v6.4...v6.4.1

`v2026.02.0`

Compare Source

What's Changed (Docker Specific)

Pin base image by sha to catch silent rebuilds by @yubiuser in #1965
Set fixed buildx version to mitigate issues with buildx version 0.31.1 by @yubiuser in #1987

Full Changelog: pi-hole/docker-pi-hole@2025.11.1...2026.02.0

What's Changed (FTL v6.5)

Tweak undocumented wait-for option subtly by @DL6ER in pi-hole/FTL#2707
update gravity - improve domain validation processing speed by @rrobgill in pi-hole/FTL#2710
Update embedded SQLite3 to 3.51.1 by @DL6ER in pi-hole/FTL#2731
Update embedded dnsmasq to 2.92rc1 by @DL6ER in pi-hole/FTL#2730
Fix documentation - Do not use equal sign with pihole-FTL --config command by @rdwebdesign in pi-hole/FTL#2736
Add dns.cache.rrtype by @Manakuremati in pi-hole/FTL#2740
Enhancements to the documentation markdown generator by @PromoFaux in pi-hole/FTL#2741
Network Overview - obtain MAC and hostname from dhcp.leases by @rrobgill in pi-hole/FTL#2727
fix: make get_domains parameters optional by @tien in pi-hole/FTL#2278
Escape unprintable characters in invalid host names by @DL6ER in pi-hole/FTL#2601
Implement better allOf handling in API verifier by @DL6ER in pi-hole/FTL#2745
Update build containers to Alpine 3.23 by @DL6ER in pi-hole/FTL#2743
Add option to hide network connection errors by @DL6ER in pi-hole/FTL#2749
Harden default Content Security Policy (CSP) by @Erasure5959 in pi-hole/FTL#2754
Fix computation of NTP server's root delay by @DL6ER in pi-hole/FTL#2760
Teleporter: Fix for custom gravity.db path by @DL6ER in pi-hole/FTL#2758
Upgrade embedded Lua to 5.5 by @DL6ER in pi-hole/FTL#2626
Add missing [forwarded] property in GET /api/history/database by @DL6ER in pi-hole/FTL#2750
Update SQLite3 to 3.51.2 by @DL6ER in pi-hole/FTL#2761
Low-memory hardware optimizations by @DL6ER in pi-hole/FTL#2757
Reduce startup delay by @DL6ER in pi-hole/FTL#2725
home.arpa and internal TLDs may be non-local without revServer by @DL6ER in pi-hole/FTL#2772

New Contributors

@Erasure5959 made their first contribution in pi-hole/FTL#2754

Full Changelog: pi-hole/FTL@v6.4.1...v6.5

What's Changed (Web v6.4.1)

Set the end date for live query update to end of epoch by @rrobgill in pi-hole/web#3677
Improve initial loading of Query Log by @DL6ER in pi-hole/web#3715

Also fixes two security advisories:

GHSA-6xp4-jw73-f4qp: fixed with pi-hole/web@d328f14
GHSA-8rw8-vjgp-rwj6: fixed with pi-hole/web@1a0c6f4

Full Changelog: pi-hole/web@v6.4...v6.4.1

What's Changed (Core v6.4)

Remove wget from alpine dependencies by @darkexplosiveqwx in pi-hole/pi-hole#6484
Remove custom FTL FirewallD zone checks from debug log by @rdwebdesign in pi-hole/pi-hole#6481
Add Alpine 3.23 to test suite by @yubiuser in pi-hole/pi-hole#6488
Debug log - Add colors to gravity tables by @rdwebdesign in pi-hole/pi-hole#6485
Use configured location for web repo when updating or repairing by @rrobgill in pi-hole/pi-hole#6470
Add missing -g to the message in gravity recovery command by @rdwebdesign in pi-hole/pi-hole#6513
Don't install unused /usr/local/share/man/man5 by @darkexplosiveqwx in pi-hole/pi-hole#6526

Full Changelog: pi-hole/pi-hole@v6.3...v6.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

madic-creates self-assigned this May 9, 2026

madic-creates force-pushed the renovate/ghcr.io-pi-hole-pihole-2026.x branch from d1ffac4 to 55fd8f0 Compare May 11, 2026 21:20

madic-creates force-pushed the renovate/ghcr.io-pi-hole-pihole-2026.x branch from 55fd8f0 to cab0438 Compare June 14, 2026 21:15

madic-creates force-pushed the renovate/ghcr.io-pi-hole-pihole-2026.x branch from cab0438 to e998fb8 Compare July 7, 2026 03:38

chore(deps): update ghcr.io/pi-hole/pihole docker tag to v2026

9397ce2

madic-creates force-pushed the renovate/ghcr.io-pi-hole-pihole-2026.x branch from e998fb8 to 9397ce2 Compare July 7, 2026 18:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update ghcr.io/pi-hole/pihole docker tag to v2026#160

chore(deps): update ghcr.io/pi-hole/pihole docker tag to v2026#160
madic-creates wants to merge 1 commit into
mainfrom
renovate/ghcr.io-pi-hole-pihole-2026.x

madic-creates commented May 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

madic-creates commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed (Docker Specific)

Security Fixes

What's Changed (FTL v6.7)

New Contributors

What's Changed (Core v6.4.3)

New Contributors

What's Changed (Web v6.6)

What's Changed (Docker Specific)

New Contributors

What's Changed (Web 6.5.1)

New Contributors

Upgrade impact

What's Changed (Docker Specific)

New Contributors

What's Changed

New Contributors

New component versions included in this tag:

What's Changed (FTL v6.6.1)

Security advisories

New Contributors

What's Changed (Core v6.4.2)

Security advisories

What's Changed (Docker Specific - all related to CI/build)

New Contributors

Component Release Notes

What's Changed (FTL v6.6)

Security Advisories

New Contributors

What's Changed (Web v6.5)

Security Advisories

New Contributors

What's Changed (Core v6.4.1)

Security Advisories

New Contributors

What's Changed (Docker Specific)

What's Changed (FTL v6.5)

New Contributors

What's Changed (Web v6.4.1)

What's Changed (Core v6.4)

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

madic-creates commented May 9, 2026 •

edited

Loading