[mortyops]

This PR contains the following updates:

Package	Update	Change	Pending
docker.io/binwiederhier/ntfy (source)	minor	v2.33.1 → v2.34.0	v2.35.0

---

Release Notes

binwiederhier/ntfy (docker.io/binwiederhier/ntfy)

v2.34.0

Compare Source

This release prepares the experimental cluster to run behind load balancers: nodes drain on shutdown instead of dropping all of their clients at once, ntfy can listen on several addresses, and access changes reach every node. It also fixes a revoked or deleted user keeping some of their subscriptions, on every server.

Features:

• Allow several comma-separated addresses in listen-http, so a load balancer can hold more than ~63k connections to one ntfy node
• Cluster nodes drain on shutdown: an active node withdraws (stops being ready), then turns read-only and closes its subscriber connections gradually (experimental-cluster-drain-delay, experimental-cluster-drain-duration), so its clients move to the other nodes without a reconnect storm (experimental, see draining on shutdown)

Security:

• End all of a user's subscriptions when their access to a topic is reset or the user is deleted: only the first one was ended, so the others kept receiving the topic's messages (#​1845, thanks to @​gigioneggiando for reporting)
• In an experimental cluster, tell the other nodes when access changes (e.g. a reservation or a revoked permission), so they reload their access cache and disconnect subscribers who lost access; the access cache reload also catches changes made elsewhere, e.g. by the ntfy access CLI, and now runs every 67 seconds instead of 87

Bug fixes + maintenance:

• Fix a deadlock when ending subscriptions (reserving a topic with live subscribers, revoking access, deleting a user) while debug logging or log-level-overrides is on: the subscriptions' topic stayed locked for good
• Fix a data race when log-level-overrides changes (e.g. on a config reload with SIGHUP) while the server logs

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a clean, single-line image tag bump (v2.33.1 → v2.34.0) in the ntfy HelmRelease. No other manifest lines change, no secrets are introduced, and the release notes confirm only minor features and bug fixes.

Change-by-change findings

• kubernetes/apps/base/selfhosted/ntfy/app/helmrelease.yaml — tag: v2.33.1 → v2.34.0. The diff is a single addition/deletion on line 26. The release notes for v2.34.0 describe load-balancer drain, multi-address listening, and a subscription-access fix — all additive, no breaking API changes. No postRenderer, no secrets, no healthChecks: target change, no enableDefaultDeny omission, no keyType: aes256k drift, no rgw_sigv4_insecure removal. The dependsOn: rook-ceph-cluster and external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN} annotations are unchanged and consistent.

Required Checks

Check	Status	Rationale
validate manifest against target cluster version	satisfied	The diff changes only the tag field on line 26; no version-sensitive fields (e.g. apiVersion, kind, spec.healthChecks, nodeSelector) are touched, so the manifest remains valid against the target cluster version.
check for resource quota / limit changes	satisfied	The diff is a single-line tag bump; resources.requests and resources.limits are unchanged (cpu 50m/200m, memory 64Mi/256Mi).

Standards Compliance

• Schema comment: # yaml-language-server: $schema=... is present — ✅
• Layout: kubernetes/apps/base/selfhosted/ntfy/app/helmrelease.yaml follows the base/<ns>/<app>/ convention — ✅
• No plaintext secrets: only ${SECRET_DOMAIN} and ${KOPIUR_CLAIM:-ntfy} variables — ✅
• No postRenderer running bash: not present — ✅
• No secrets under **/resources/**: not present — ✅
• healthChecks: targets rendered workload: the HelmRelease uses wait: false (default) and healthChecks is not overridden here; the rendered Deployment is the signal — ✅
• enableDefaultDeny: not a CCNP, so the rule does not apply — ✅
• keyType: aes256k: not a Ceph CSI change — ✅
• rgw_sigv4_insecure: not a Ceph config change — ✅

Tool Harness Findings

None.

Unknowns or Needs Verification

• The external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}" annotation uses a variable; if SECRET_DOMAIN resolves to a public domain, the internal-only service would be exposed on the public listener. This is a pre-existing configuration, not a regression from this bump, but worth confirming in production if the domain is public.
• The dependsOn: rook-ceph-cluster is unchanged; no new volume claims are introduced, so the existing VolSync/backup wiring remains valid.

Summary

A low-risk, single-line image bump with no breaking changes, no secrets, and no resource-limit modifications. Approved.

[mortyops]

--- Deployment selfhosted/ntfy
+++ Deployment selfhosted/ntfy
@@ -33,7 +33,7 @@
       containers:
       - args:
         - serve
-        image: docker.io/binwiederhier/ntfy:v2.33.1
+        image: docker.io/binwiederhier/ntfy:v2.34.0
         livenessProbe:
           failureThreshold: 3
           httpGet:

[mortyops]

--- HelmRelease selfhosted/ntfy
+++ HelmRelease selfhosted/ntfy
@@ -42,7 +42,7 @@
             - serve
             image:
               repository: docker.io/binwiederhier/ntfy
-              tag: v2.33.1
+              tag: v2.34.0
             probes:
               liveness:
                 custom: true