[mortyops]

This PR contains the following updates:

Package	Type	Update	Change
opentofu	tools	patch	1.13.1 → 1.13.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

opentofu/opentofu (opentofu)

v1.13.2

Compare Source

SECURITY ADVISORIES:

• Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init. (#​4681)
• Filter out compromised intermediate certificates (#​4750)

BUG FIXES:

• Lifecycle destroy will no longer crash when given an expression with references (#​4648)
• tofu workspace select and tofu workspace delete autocompletion predicts from the existing workspaces. This restores the behavior pre-v1.13 (#​4706)
• Combined usage of -chdir and -version flags does not show an error anymore but instead shows the version of the tofu binary (#​4707)
• Symbol libraries are now saved in plan files and no-longer prevent applying of plan files (#​4734)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a straightforward Renovate patch bump of opentofu from 1.13.1 to 1.13.2 in .mise.toml. The change is a single-line version update with no structural impact on the cluster.

Change-by-Change Findings

.mise.toml — opentofu version bump (1.13.1 → 1.13.2)

• Scope: The PR title correctly identifies this as a github-release type update (the opentofu tool is installed via aqua in .mise.toml, not as a container image). The commit message fix(github-release): update release opentofu ( 1.13.1 ➔ 1.13.2 ) follows the repo's type(scope): description convention.
• Version pin: 1.13.2 is a valid semver patch release. The diff shows a clean one-line replacement with no extraneous whitespace or formatting changes.
• Security context: The release notes cite two security advisories (excessive CPU on HTTP2, filtered compromised intermediate certs). This is a legitimate patch update.
• No cluster impact: .mise.toml is a developer tooling config (mise/aqua package manager). It is not applied by Flux to the cluster. Merging this PR does not change any running workload.
• Renovate automerge: The PR body confirms automerge is enabled. This is a routine patch bump — no special handling needed.

Standards Compliance

• No plaintext secrets: Confirmed — no secrets in the diff.
• No postRenderer bash: N/A (not a HelmRelease).
• No secrets under **/resources/**: N/A.
• No tofu apply/tofu destroy in terraform/authentik/: N/A.
• No GitHub Actions PR approval workflow: N/A.
• No Flux Kustomization changes: N/A.
• No Cilium CCNP changes: N/A.
• No Ceph/GPU changes: N/A.
• No AI stack changes: N/A.

Unknowns / Needs Verification

• None. The change is a single-line version bump in a developer tooling config file with no cluster-side effect.

Required Checks

No must_check items were provided in the PR classification. No mandatory review questions to disposition.

Tool Harness Findings

No tool harness output was included in the corpus.

Requirement Coverage

Requirement	Status	Evidence
healthChecks must target rendered workload	unknown	No Flux/Kustomization manifests changed; N/A for this PR
CCNP nodeSelector label survives to host endpoint	unknown	No Cilium policy manifests changed; N/A
permissions narrowest set	unknown	No workflow files changed; N/A
security.cephx.csi keyType	unknown	No Ceph manifests changed; N/A
cephConfig rgw_sigv4_insecure	unknown	No Ceph manifests changed; N/A