feat(oci/postgres-backup-local)!: Update 16 ➼ 17 - template

[tinfoild]

This PR contains the following updates:

Package	Update	Change
docker.io/prodrigestivill/postgres-backup-local	major	16 → 17

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	e543d8e
Status:	✅  Deploy successful!
Preview URL:	https://04d1d5b8.jjgadgets-biohazard.pages.dev
Branch Preview URL:	https://renovate-template-docker-io-s6ra.jjgadgets-biohazard.pages.dev

View logs

[tinfoild]

--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-default CronJob: pg/pg-default-postgres-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-default CronJob: pg/pg-default-postgres-dump-local

@@ -45,13 +45,13 @@

                   name: pg-default-pguser-postgres
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-default-pguser-postgres
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:73f18e914cb6ffb29840b3fc5be0763f48eb1ca05f093c769ccd13982a634544
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:483fa15ecd998302bd312fc380cb1b3683a940881d9099d6dfe65bcc1e2714e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi
--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/gotosocial-db CronJob: gotosocial/pg-gotosocial-gotosocial-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/gotosocial-db CronJob: gotosocial/pg-gotosocial-gotosocial-dump-local

@@ -45,13 +45,13 @@

                   name: pg-gotosocial-pguser-gotosocial
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-gotosocial-pguser-gotosocial
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:73f18e914cb6ffb29840b3fc5be0763f48eb1ca05f093c769ccd13982a634544
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:483fa15ecd998302bd312fc380cb1b3683a940881d9099d6dfe65bcc1e2714e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 2Gi
--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-home CronJob: pg/pg-home-postgres-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-home CronJob: pg/pg-home-postgres-dump-local

@@ -45,13 +45,13 @@

                   name: pg-home-pguser-postgres
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-home-pguser-postgres
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:73f18e914cb6ffb29840b3fc5be0763f48eb1ca05f093c769ccd13982a634544
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:483fa15ecd998302bd312fc380cb1b3683a940881d9099d6dfe65bcc1e2714e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi
--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/authentik-db CronJob: authentik/pg-authentik-authentik-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/authentik-db CronJob: authentik/pg-authentik-authentik-dump-local

@@ -45,13 +45,13 @@

                   name: pg-authentik-pguser-authentik
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-authentik-pguser-authentik
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:73f18e914cb6ffb29840b3fc5be0763f48eb1ca05f093c769ccd13982a634544
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:483fa15ecd998302bd312fc380cb1b3683a940881d9099d6dfe65bcc1e2714e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi
--- kube/deploy/apps/piped/app Kustomization: flux-system/piped-app HelmRelease: piped/piped

+++ kube/deploy/apps/piped/app Kustomization: flux-system/piped-app HelmRelease: piped/piped

@@ -117,13 +117,13 @@

             - /app/piped-proxy
             env:
               BACKEND_HOSTNAME: piped
               TZ: null
             image:
               repository: docker.io/1337kavin/piped-proxy
-              tag: latest@sha256:ef68dc896ce2e3c0e4abda7eda99dbf3272262be490c0b4b3cd54c36a357c264
+              tag: latest@sha256:84888008b229b422ac16795429cd154ca90f5e361a794c9b14dc43047d602314
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
             resources:

[tinfoild]

kube/helmrelease/out00

[tinfoild]

kube/helmrelease/out00

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-home CronJob: pg/pg-home-postgres-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-home CronJob: pg/pg-home-postgres-dump-local

@@ -45,13 +45,13 @@

                   name: pg-home-pguser-postgres
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-home-pguser-postgres
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:a0103fbce0c48ccc7693ddbb2a2bfa733048db845354f635efef9e4566de185d
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:e803bd9eb4bfb42e9b3e74ba411227f3d55da292905800395659cc579b6641e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi
--- kube/deploy/core/db/pg/clusters/template Kustomization: authentik/authentik-db CronJob: authentik/pg-authentik-authentik-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: authentik/authentik-db CronJob: authentik/pg-authentik-authentik-dump-local

@@ -46,13 +46,13 @@

                   name: pg-authentik-pguser-authentik
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-authentik-pguser-authentik
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:a0103fbce0c48ccc7693ddbb2a2bfa733048db845354f635efef9e4566de185d
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:e803bd9eb4bfb42e9b3e74ba411227f3d55da292905800395659cc579b6641e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi
--- kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-default CronJob: pg/pg-default-postgres-dump-local

+++ kube/deploy/core/db/pg/clusters/template Kustomization: flux-system/1-core-db-pg-clusters-default CronJob: pg/pg-default-postgres-dump-local

@@ -45,13 +45,13 @@

                   name: pg-default-pguser-postgres
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   key: password
                   name: pg-default-pguser-postgres
-            image: docker.io/prodrigestivill/postgres-backup-local:16@sha256:a0103fbce0c48ccc7693ddbb2a2bfa733048db845354f635efef9e4566de185d
+            image: docker.io/prodrigestivill/postgres-backup-local:17@sha256:e803bd9eb4bfb42e9b3e74ba411227f3d55da292905800395659cc579b6641e8
             imagePullPolicy: IfNotPresent
             name: postgres-backup
             resources:
               limits:
                 cpu: 1000m
                 memory: 1Gi

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 09:29 SGT
🤖 Scanner: Ciel Security Scanner
🔗 PR: #1442 — feat(oci/postgres-backup-local)!: Update 16 ➼ 17 - template
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 3 HIGH, 1 MEDIUM (all affect both versions equally)

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	3
MEDIUM / MODERATE	1
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	4

---

Results

Package: docker.io/prodrigestivill/postgres-backup-local

• Ecosystem: Docker (base: postgres:16 → postgres:17)
• Old version: 16 (PG 16.9) — VULNERABLE (4 client-side CVEs)
• New version: 17 (PG 17.5) — VULNERABLE (same 4 CVEs, not fixed)

Both images built on 2025-09-26; PG 16.9 and 17.5 share identical patch levels. The container uses pg_dump/pg_dumpall client tools to connect to a remote PostgreSQL server.

1. CVE-2025-8714 / GHSA-6m5q-cc57-2mj6 — Severity: HIGH (8.8)

   • pg_dump code injection via superuser-controlled server
   • Fixed in: 16.10, 17.6 ❌ Not fixed
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-8714

2. CVE-2025-8715 / GHSA-xh8r-9824-53cf — Severity: HIGH (8.8)

   • pg_dump newline injection via crafted object name
   • Fixed in: 16.10, 17.6 ❌ Not fixed in either version
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-8715

3. CVE-2026-6477 / GHSA-jm5f-gpfq-q9h3 — Severity: HIGH (8.8)

   • libpq PQfn stack buffer overflow via lo_read(); affects pg_dump
   • Fixed in: 16.14, 17.10 ❌ Not fixed in either version
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-6477

4. CVE-2025-12818 / GHSA-pr6x-gg24-6wfp — Severity: MEDIUM (5.9)

   • libpq integer wraparound undersized allocation
   • Fixed in: 16.11, 17.7 ❌ Not fixed in either version
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-12818

Non-applicable findings

Finding	Sev	Reason
CVE-2024-10977	LOW	Fixed in 16.5/17.1 — both patched
CVE-2025-1094	HIGH	Fixed in 16.7/17.3 — both patched
CVE-2025-4207	MED	Fixed in 16.9/17.5 — both patched
CVE-2026-6475	HIGH	pg_basebackup — tool not used by this image
+5 more	H/M	Server-side only — not relevant to client tools

Changelog Security Highlights (16 → 17)

• PG 17.0 — Dropped adminpack extension (removed attack surface)
• PG 17.0 — Safe search_path enforced for maintenance operations
• go-cron v0.0.11 — No known CVEs found across any source

---

Recommendations

• MERGE PRIORITY: LOW — Both versions share the same unpatched client-side CVEs. This upgrade does not remediate any specific vulnerability; it is a standard major-version bump for currency. No new vulnerabilities are introduced.
• ⚠️ All 4 CVEs require a malicious server or MITM to exploit. Risk is low if the PG server is trusted.
• 💡 Consider updating to :18 (PG 18.4) which fixes several of these CVEs (CVE-2025-12818, CVE-2026-6477, etc.).

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.