fix(container): update image mirror.gcr.io/mxdcodes/colota-forwarder (5c4e9a3 ➔ aa9232b)

[drag0n141-bot]

This PR contains the following updates:

Package	Update	Change
mirror.gcr.io/mxdcodes/colota-forwarder	digest	5c4e9a3 → aa9232b

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[drag0n141-bot]

--- kubernetes/apps/default/colota-forwarder/app Kustomization: default/colota-forwarder HelmRelease: default/colota-forwarder

+++ kubernetes/apps/default/colota-forwarder/app Kustomization: default/colota-forwarder HelmRelease: default/colota-forwarder

@@ -37,13 +37,13 @@

               TZ: Europe/Berlin
             envFrom:
             - secretRef:
                 name: '{{ .Release.Name }}-secret'
             image:
               repository: mirror.gcr.io/mxdcodes/colota-forwarder
-              tag: latest@sha256:5c4e9a384edb9d8963b31eb34a9242fa97d695b92728116cfa50671ff60c3e23
+              tag: latest@sha256:aa9232b7f198c96f87c1b22ea3f7947f3bdd62186e4e28cc70161bd3a2876b0f
             resources:
               limits:
                 memory: 128Mi
               requests:
                 cpu: 10m
                 memory: 64Mi

[drag0n141-bot]

--- HelmRelease: default/colota-forwarder Deployment: default/colota-forwarder

+++ HelmRelease: default/colota-forwarder Deployment: default/colota-forwarder

@@ -47,13 +47,13 @@

           value: '3000'
         - name: TZ
           value: Europe/Berlin
         envFrom:
         - secretRef:
             name: colota-forwarder-secret
-        image: mirror.gcr.io/mxdcodes/colota-forwarder:latest@sha256:5c4e9a384edb9d8963b31eb34a9242fa97d695b92728116cfa50671ff60c3e23
+        image: mirror.gcr.io/mxdcodes/colota-forwarder:latest@sha256:aa9232b7f198c96f87c1b22ea3f7947f3bdd62186e4e28cc70161bd3a2876b0f
         name: app
         resources:
           limits:
             memory: 128Mi
           requests:
             cpu: 10m

[claude]

mxdcodes/colota-forwarder: digest 5c4e9a3 → 8fd98a5 (latest tag)

Verdict: Safe to merge

This is a digest-only bump of the floating latest tag for mxdcodes/colota-forwarder (upstream: dietrichmax/colota-forwarder). No version tag change — the repo has no new release since v0.3.1 (2026-07-20); latest tracks every push to main that touches build-relevant paths (src/**, package*.json, Dockerfile, etc., per docker-publish.yml).

I compared the previous digest's build point (~2026-07-26) against the new one (2026-08-04) and found the only commits that would have triggered a rebuild were:

• chore(deps): fix non-major npm audit vulnerabilities — touches only package-lock.json, and every changed entry is a "dev": true devDependency.
• chore(deps): update dependency webpack to v5.109.2 — webpack is a build-time devDependency.
• ci: remove npm audit step from Docker publish workflow — only touches .github/workflows/docker-publish.yml.

No commits in that window touched src/** or Dockerfile. There is no application code or base-image change — this rebuild is a byproduct of dev-dependency/CI churn, not a functional update.

Sources consulted:

• https://github.com/dietrichmax/colota-forwarder/commits/main
• https://github.com/dietrichmax/colota-forwarder/releases/tag/v0.3.1
• https://github.com/dietrichmax/colota-forwarder/blob/main/.github/workflows/docker-publish.yml

[claude]

mxdcodes/colota-forwarder: digest 5c4e9a3 → f509f25 (latest tag)

Verdict: Safe to merge

This supersedes my prior review on this PR (which covered digest 5c4e9a3 → 8fd98a5, submitted before Renovate rebased to the current digest). Only one additional upstream commit landed since that review's cutoff (2026-08-04 ~18:05 UTC) that would have triggered a rebuild of dietrichmax/colota-forwarder:

• bc3b5b1 — "ci: scope dependency audit to runtime deps" (2026-08-04 18:57 UTC). Touches package.json and .github/workflows/ci.yml, matching the docker-publish.yml path filter (package*.json), which is why it produced a new digest. The actual change is limited to the scripts.check line switching npm audit --audit-level=high to npm audit --omit=dev --audit-level=high — a CI-only audit-scoping tweak, mirroring the CI workflow change already covered in my previous review. No src/**, no Dockerfile, no runtime dependency bump.

No new release exists upstream since v0.3.1 (2026-07-20). This remains a no-op functional rebuild of the floating latest tag — same conclusion as before, just re-verified against the new digest actually present in this PR's diff.

colota-forwarder has no other consumers in this repo (only kubernetes/apps/default/colota-forwarder/**), so there's no cross-service impact to assess.

Sources consulted:

• https://github.com/dietrichmax/colota-forwarder/commits/main
• dietrichmax/colota-forwarder@bc3b5b1
• https://github.com/dietrichmax/colota-forwarder/blob/main/.github/workflows/docker-publish.yml
• https://github.com/dietrichmax/colota-forwarder/releases/tag/v0.3.1

[claude]

mxdcodes/colota-forwarder: digest 5c4e9a3 → aa9232b (latest tag)

Verdict: Safe to merge

This supersedes my prior reviews on this PR (which covered digests 8fd98a5 and f509f25). Since the last review's cutoff (bc3b5b1, 2026-08-04 ~18:57 UTC), upstream dietrichmax/colota-forwarder merged five more Renovate PRs and cut a new release, v0.3.2 (2026-08-04), which is what produced this new digest:

• chore(deps): update gcr.io/distroless/nodejs24-debian13:nonroot docker digest — final-stage base image digest bump only.
• chore(deps): update node.js to d32cdf6 — builder-stage base image digest bump only.
• chore(deps): update patch updates (webpack-cli 7.2.1 → 7.2.2) — devDependency only.
• chore(deps): lock file maintenance — bumps a batch of transitive deps; all are dev: true (typescript/webpack/babel tooling) except media-typer (1.1.0 → 1.1.1), a transitive runtime dep of express, which is a trivial patch bump with no changelog entries indicating behavior change.
• Version bump to v0.3.2 — only compose.yml's image tag reference in the upstream repo; no application source changed.

The upstream v0.3.2 release notes explicitly list only dependency/CI maintenance items (13 Renovate PRs), with no application feature or breaking changes. No src/** changes and no runtime dependency version bumps beyond the trivial media-typer patch.

colota-forwarder has no other consumers in this repo (only kubernetes/apps/default/colota-forwarder/**), so there's no cross-service impact to assess.

Sources consulted:

• https://github.com/dietrichmax/colota-forwarder/releases/tag/v0.3.2
• https://github.com/dietrichmax/colota-forwarder/commits/main
• dietrichmax/colota-forwarder@94e0af6
• dietrichmax/colota-forwarder@ffc71be
• dietrichmax/colota-forwarder@58805a7