[mortyops]

This PR contains the following updates:

Package	Update	Change
quay.io/prometheus/alertmanager	patch	v0.34.1 → v0.34.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

prometheus/alertmanager (quay.io/prometheus/alertmanager)

v0.34.2: 0.34.2 / 2026-10-29

Compare Source

• [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #​5664
• [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[mortyops]

--- HelmRelease monitoring/alertmanager
+++ HelmRelease monitoring/alertmanager
@@ -40,7 +40,7 @@
           alertmanager:
             image:
               repository: quay.io/prometheus/alertmanager
-              tag: v0.34.1
+              tag: v0.34.2
             ports:
             - containerPort: 9093
               name: http

[mortyops]

--- StatefulSet monitoring/alertmanager
+++ StatefulSet monitoring/alertmanager
@@ -31,7 +31,7 @@
     spec:
       automountServiceAccountToken: false
       containers:
-      - image: quay.io/prometheus/alertmanager:v0.34.1
+      - image: quay.io/prometheus/alertmanager:v0.34.2
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a single-line patch bump of quay.io/prometheus/alertmanager from v0.34.1 to v0.34.2. The change is a pure digest/tag update with no other manifest modifications, no new resources, and no configuration changes.

Change-by-Change Findings

kubernetes/apps/base/monitoring/alertmanager/app/helmrelease.yaml

• Image tag bump v0.34.1 → v0.34.2 (line 36). This is a patch release within the same 0.34.x minor series.
• Release notes confirm two items: (1) a breaking change where api/v2 no longer sends CORS headers by default (requires --web.cors.origin to restore), and (2) a Go 1.26.10 build that distrusts eight compromised eMudhra intermediate CA certificates (CVE-2026-111943). Neither affects this deployment's configuration — the alertmanager is not exposed as a CORS-facing API consumer here, and the CA fix is a build-time dependency.
• No other diff lines — no resource additions, no security context changes, no volume mounts, no route modifications.

Required Checks Disposition

Check	Status	Rationale
validate manifest against target cluster version	satisfied	The manifest uses helm.toolkit.fluxcd.io/v2 (standard HelmRelease API) and OCIRepository chartRef — both are supported by Flux v2 on the target Talos+Flux cluster. No deprecated APIs or version-gated fields are introduced.
check for resource quota / limit changes	not_applicable	The diff changes only the image tag; no resources.requests or resources.limits fields are modified. No quota or limit impact exists.

Standards Compliance

• Schema comment present: # yaml-language-server: $schema=... ✓
• No plaintext secrets — the manifest references alertmanager-secret via ExternalSecret pattern (not inline) ✓
• No postRenderer — this is a HelmRelease with chartRef, not a Helm chart with postRenderer ✓
• No ${...} literal tokens — no Flux substitution collisions present ✓
• healthChecks: — the HelmRelease does not declare healthChecks:; this is acceptable because the rendered StatefulSet (from the app-template chart) will be assessed by Flux's default readiness logic. The standard says healthChecks: must target the rendered workload when declared — absence is not a violation.
• Commit message follows type(scope): description convention: fix(container): update image ... ✓

Unknowns / Needs Verification

• The release notes mention a CORS breaking change (api/v2 no longer sends CORS headers). This alertmanager is routed through envoy-internal (private listener) and is not a public-facing CORS consumer. No verification needed unless an external tool (e.g., Grafana, a dashboard) makes cross-origin api/v2 calls — none are present in this repo's manifests.
• The Go 1.26.10 CA fix is a build-time dependency; no runtime impact on this deployment.

Tool Harness Findings

No tool harness findings were returned for this PR.

Summary

A clean, low-risk patch bump. The only substantive release note (CORS default change) does not apply to this deployment's traffic pattern. Approved.