[95gabor]

Dependency & security audit (2026-10-29)

Target: this fork (95gabor/unifi-network-application) only.

Changes

Item	Before	After
helm/chart-releaser-action (release.yaml)	v1.7.0	v1.8.0
norwoodj/helm-docs pre-commit rev	"" (unpinned/invalid)	v1.14.2
Chart version (+ README badge)	0.4.12	0.4.13

Audited, already current (no change)

• GitHub Actions (checked tags of upstream repos): actions/checkout v7 (latest v7.0.1), actions/setup-python v7 (v7.1.0), gabe565/setup-helm-docs-action v1 (v1.0.4), pre-commit/action v3.0.1, peter-evans/create-pull-request v8 (v8.1.1), azure/setup-helm v5 (v5.0.1), docker/login-action v4 (v4.7.0).
• Helm pinned in release workflow: v3.22.1 is the latest 3.x.
• Pre-commit hooks: conventional-pre-commit v4.4.0, pre-commit-hooks v6.0.0, gruntwork-io/pre-commit v0.1.30 — all latest.
• Docker images: mongo:4.4.30@sha256:4be76f67… — digest verified to equal the current multi-arch index digest on Docker Hub. linuxserver/unifi-network-application:10.6.106 is managed by the app-version bot (see bump(unifi-network-application): update app version #14).

Findings / not changed (need maintainer decision)

• MongoDB 4.4 is EOL (Feb 2024) and has no further security patches; 4.4.30 is its last release. Moving to a supported LTS (e.g. 7.0/8.0) needs a staged featureCompatibilityVersion upgrade for existing PVC data and a check against UniFi's supported Mongo range, so I did not change it automatically. Recommended follow-up.
• Actions are pinned to tags, not commit SHAs; SHA pinning would reduce supply-chain risk. Left as-is to match existing convention.
• The linuxserver image is tag-pinned via appVersion but has no digest.
• No Node/Alpine base images exist in this repo (Helm chart only), so the node/alpine pin guideline is N/A.

Verification

• pre-commit run --all-files: all hooks pass (incl. helmlint, helm-docs v1.14.2).
• helm lint (v3.22): 0 failures; helm template renders OK with expected pinned images.
• Note: CI workflow changes (chart-releaser) only exercise on release.

Related PRs

• bump(unifi-network-application): update app version #14 (open, bot app-version bump): independent, left open — merge separately.
• fix(chart): honor persistence toggles and pin helm-docs rev #6 (open, "pin helm-docs rev"): its helm-docs pin overlaps with this PR; consider closing fix(chart): honor persistence toggles and pin helm-docs rev #6 if its other changes (persistence toggles) are merged/obsolete, otherwise rebase after this.
• chore(deps): update actions, pre-commit hooks, pin mongo digest #13 (previous dependency update, already applied on main).

---

Generated by Claude Code