chore(oci/thelounge): update 4.4.3 ➼ e631ab6

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
ghcr.io/thelounge/thelounge	digest	3b62b12 → e631ab6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	b31334e
Status:	✅  Deploy successful!
Preview URL:	https://c7f8fbf4.jjgadgets-biohazard.pages.dev
Branch Preview URL:	https://renovate-ghcr-io-thelounge-t-v39j.jjgadgets-biohazard.pages.dev

View logs

[tinfoild]

kube/kustomization/out00

--- kube/deploy/apps/thelounge/app Kustomization: flux-system/thelounge-app HelmRelease: thelounge/thelounge

+++ kube/deploy/apps/thelounge/app Kustomization: flux-system/thelounge-app HelmRelease: thelounge/thelounge

@@ -52,13 +52,13 @@

     env:
       TZ: null
     global:
       fullnameOverride: thelounge
     image:
       repository: ghcr.io/thelounge/thelounge
-      tag: 4.4.3@sha256:3b62b12c9673534096fc6838f6614354fb4fb9376ced51fbcb0c3e8a20c3ce03
+      tag: 4.4.3@sha256:e631ab609fd06a96bde9e23c44a65e45519cf8363d63fa5d2b2ebde609765f8c
     ingress:
       main:
         enabled: true
         hosts:
         - host: thelounge
           paths:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 06:11 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5665 — chore(oci/thelounge): update 4.4.3 ➼ e631ab6
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 1 (LOW)

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	1
UNKNOWN / NEEDS VERIFICATION	0
Total	1

---

Results

Package: ghcr.io/thelounge/thelounge (Docker)

• Ecosystem: npm (the Lounge app) / Docker (container image)
• Old version: 4.4.3@sha256:3b62b12 — VULNERABLE (1 LOW advisory)
• New version: 4.4.3@sha256:e631ab6 — VULNERABLE (same 1 LOW advisory; digest-only rebuild)

This is a digest-only update — the thelounge version tag (4.4.3) is unchanged. The Docker image was rebuilt from an updated node:18-alpine base image, likely picking up OS-level security patches in Alpine packages.

Vulnerabilities applicable to version 4.4.3 (both old and new)

1. GHSA-g49q-jw42-6x85 — Severity: LOW (no CVSS score assigned)
   • Description: The Lounge identd (port 113) may publicly disclose all usernames/idents by not checking the connection address per RFC 1413, making it trivial to enumerate all connected users.
   • Affected versions: all versions <= 4.4.3
   • Fixed in: 4.5.0
   • Sources: OSV.dev, GHSA
   • Evidence: GHSA-g49q-jw42-6x85 | Identd: fix various issues thelounge/thelounge#4872
   • Status: ⚠️ Not fixed by this PR (requires upgrade to 4.5.0+)

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
None	—	All other sources returned no results for thelounge

Changelog Security Highlights (digest change 3b62b12 → e631ab6)

• No thelounge code changes — this is a Docker rebuild with updated base image layers
• Likely includes Alpine package security patches from the node:18-alpine base image OS updates
• To fully resolve the identd advisory, upgrade to thelounge 4.5.0+ in a separate PR

Source scan summary

Source	Status	Notes
OSV.dev	✅ Scanned	1 finding: GHSA-g49q-jw42-6x85 (LOW)
NVD	✅ Scanned	No CVEs for thelounge
GHSA	✅ Scanned	1 advisory: GHSA-g49q-jw42-6x85 (LOW)
GHSL	✅ Scanned	No publications found
CISA KEV	✅ Scanned	No entries for thelounge
FortiGuard	✅ Scanned	No advisories for thelounge
CVE.org	✅ Scanned	No CVEs found for thelounge
Changelog	✅ Scanned	v4.4.3 release notes reviewed; digest change is base-image rebuild

---

Recommendations

• MERGE PRIORITY: LOW — The only finding (GHSA-g49q-jw42-6x85) is LOW severity and affects both old and new versions equally. This digest update likely includes Alpine base OS security patches, which is beneficial but not urgent.
• The identd vulnerability is not resolved by this PR — it requires a separate upgrade of thelounge to v4.5.0+ (see PR feat(oci/zigbee2mqtt): update 2.9.2 ➼ 2.14.2 #5668 for the 4.5.0 version bump).
• Merge at own discretion; no blocking vulnerabilities are introduced by this change.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.