feat(container): update image ghcr.io/dgtlmoon/changedetection.io ( 0.52.9 ➔ 0.54.3 )

[mortyops]

This PR contains the following updates:

Package	Update	Change
ghcr.io/dgtlmoon/changedetection.io	minor	0.52.9 → 0.54.3

---

Release Notes

dgtlmoon/changedetection.io (ghcr.io/dgtlmoon/changedetection.io)

v0.54.3

Compare Source

What's Changed

• Update messages.po in French translation by @​RithyNicolasTAN in #​3926
• Adding Ukrainian (uk) translations, rebuilding translations. by @​dgtlmoon in #​3936
• CVE-2026-27696 Small fix - Restricted hostnames can still be added but are only checked at fetch-time (not when rendering lists etc) by @​dgtlmoon in #​3938

New Contributors

• @​RithyNicolasTAN made their first contribution in #​3926

Full Changelog: dgtlmoon/changedetection.io@0.54.2...0.54.3

v0.54.2

Compare Source

What's Changed

• Fixing change_datetime notification token (and adding test) by @​dgtlmoon in #​3922
• Notification Token {{diff}} can accept arguments like {{diff_added(lines=5, context=2)}} by @​dgtlmoon in #​3923
• Processor extensible API for updating by @​dgtlmoon in #​3902
• Update jsonpath-ng requirement from ~=1.7.0 to ~=1.8.0 by @​dependabot[bot] in #​3929
• Bump the all group with 2 updates by @​dependabot[bot] in #​3931
• Unresolvable hostnames should still be added, they are security checked at fetch time by @​dgtlmoon in #​3933

Full Changelog: dgtlmoon/changedetection.io@0.54.1...0.54.2

v0.54.1

Compare Source

• CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.
• CVE-2026-27645 - Reflected XSS in RSS Single Watch request

Full Changelog: dgtlmoon/changedetection.io@0.53.7...0.54.1

v0.53.7

Compare Source

What's Changed

• Upgrading flask-socketio ( #​3910 ) by @​dgtlmoon in #​3918
• Bump referencing from 0.35.1 to 0.37.0 by @​dependabot[bot] in #​3677
• Dont pin referencing library by @​dgtlmoon in #​3919

Full Changelog: dgtlmoon/changedetection.io@0.53.6...0.53.7

v0.53.6

Compare Source

What's Changed

• Pip installs - remove flask patch and pin library versions by @​dgtlmoon in #​3912 #​3910
• Fixing exclude compression (which has some kind of memory leak with flask-socketio)

Full Changelog: dgtlmoon/changedetection.io@0.53.5...0.53.6

v0.53.5

Compare Source

What's Changed

• Backup restore by @​dgtlmoon in #​3899
• Fixing bad replacement of metadata causing possible content removal #​3906 by @​dgtlmoon in #​3908

Full Changelog: dgtlmoon/changedetection.io@0.53.4...0.53.5

v0.53.4

Compare Source

What's Changed

• Pluggy plugin hook for before and after a watch is processed by @​dgtlmoon in #​3888
• UI - Fixing realtime updates for status updates when checking by @​dgtlmoon in #​3889
• Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #​3846 by @​dgtlmoon in #​3890
• "Error 200 no content" - Some very large SPA pages make HTML to Text fail by dumping 10Mb+ into page header, strip extras. by @​dgtlmoon in #​3892
• Large html to text error 200 blank by @​dgtlmoon in #​3893
• Fix: Some SPAs with long content - Stripping tags must also find matching close tag by @​dgtlmoon in #​3895
• Puppeteer - Adding extra browser cleanup by @​dgtlmoon in #​3897
• Updates/migration - Re-run tag update, re-save to cleanup changedetection.json, code refactor by @​dgtlmoon in #​3898

Full Changelog: dgtlmoon/changedetection.io@0.53.3...0.53.4

v0.53.3

Compare Source

What's Changed

• API - Skip validation errors about server path (allows use on sub-paths/reverse proxy etc) by @​dgtlmoon in #​3886

Full Changelog: dgtlmoon/changedetection.io@0.53.2...0.53.3

v0.53.2

Compare Source

What's Changed

• Security - Adding small test and fixing overzealous filename cleaner by @​dgtlmoon in #​3884
• UI - Watch overview - Restock price, validate number before output by @​dgtlmoon in #​3883

Full Changelog: dgtlmoon/changedetection.io@0.53.1...0.53.2

v0.53.1

Compare Source

Big changes

• Very large refactor of the datastore backend, instead of all watch data stored in a single JSON DB, splits the info into uuid/watch.json and uuid/tag.json
• Lots of API fixes
• Queuing system refactor (reduces code)

What's Changed

• Bump apprise from 1.9.6 to 1.9.7 by @​dependabot[bot] in #​3800
• Update messages.po // German by @​DominikHerold in #​3797
• Cli options by @​dgtlmoon in #​3802
• add support for remote reverse proxies by @​kyeotic in #​3806
• Improved catching of errors/exceptions in Browser Steps steps by @​dgtlmoon in #​3808
• Big refactor to save watches as their own datafile with some agnostic data store backend by @​dgtlmoon in #​3775
• Db data upgrade fixes by @​dgtlmoon in #​3811
• Make watch tags link elements by @​opicron in #​3813
• API - Notification URLs werent always being validated by @​dgtlmoon in #​3812
• Ability to limit total number of watches with env var PAGE_WATCH_LIMIT by @​dgtlmoon in #​3828
• Janus queue worker not needed, improves multiple workers by @​dgtlmoon in #​3826
• Puppeteer and Playwright browser close/shutdown improvements by @​dgtlmoon in #​3830
• Bump elementpath from 5.1.0 to 5.1.1 by @​dependabot[bot] in #​3799
• Processor plugin improvements by @​dgtlmoon in #​3739
• Memory improvement - Use builtin markupsafe instead of creating a jinja2 template env each time for small strings by @​dgtlmoon in #​3836
• Limit trim history size by @​dgtlmoon in #​3834
• Improved watch global settings handling by @​dgtlmoon in #​3839
• Adding more tests and references by @​dgtlmoon in #​3841
• Rebuild translations by @​dgtlmoon in #​3842
• Fix for When MoreThanOnePriceFound() is raised, plugins dont fire by @​dgtlmoon in #​3840
• Bump pyppeteer-ng from 2.0.0rc12 to 2.0.0rc13 by @​dependabot[bot] in #​3843
• Bump psutil from 7.2.1 to 7.2.2 by @​dependabot[bot] in #​3844
• Refactor by @​dgtlmoon in #​3847
• Refactor for Tags storage by @​dgtlmoon in #​3848
• Tags update fix by @​dgtlmoon in #​3849
• API - Include missing tags in fetching watch information. #​3854 by @​dgtlmoon in #​3856
• API - Import - Ability to set any watch value as HTTP URL Query value for example api/import?processor=restock_diff&time_between_check={'hours':24} Re #​3845 by @​dgtlmoon in #​3857
• API - Import use background task to import large lists by @​dgtlmoon in #​3858
• Refactoring upgrade path by @​dgtlmoon in #​3861
• Price tracker - Use subprocess on linux for cleaner memory management. by @​dgtlmoon in #​3864
• Update python-engineio requirement from ~=4.13.0 to ~=4.13.1 by @​dependabot[bot] in #​3868
• API - Remove flask_expects_json validation, this is covered entirely by OpenAPI, update OpenAPI spec. by @​dgtlmoon in #​3871
• Update python-socketio requirement from ~=5.16.0 to ~=5.16.1 by @​dependabot[bot] in #​3869
• Avoid reprocessing if the page was the same by @​dgtlmoon in #​3867
• UI - Ability to download a complete data package (.zip) of a watch by @​dgtlmoon in #​3877
• Browser Steps - Clean off empty fields on save/update, small refactor Re #​3874, #​3879 by @​dgtlmoon in #​3880

New Contributors

• @​kyeotic made their first contribution in #​3806
• @​opicron made their first contribution in #​3813

Full Changelog: dgtlmoon/changedetection.io@0.52.9...0.53.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mortyops]

--- kubernetes/apps/selfhosted/changedetection/app Kustomization: selfhosted/changedetection HelmRelease: selfhosted/changedetection

+++ kubernetes/apps/selfhosted/changedetection/app Kustomization: selfhosted/changedetection HelmRelease: selfhosted/changedetection

@@ -74,13 +74,13 @@

             env:
               PLAYWRIGHT_DRIVER_URL: ws://localhost:3000/?stealth=1&--disable-web-security=true&--user-data-dir=~/browserless-cache-123
               PORT: 5000
               USE_X_SETTINGS: 1
             image:
               repository: ghcr.io/dgtlmoon/changedetection.io
-              tag: 0.52.9@sha256:e95931043d68da46e90498ce74ad317b392caade07186dc06bdfa1710901bf90
+              tag: 0.54.3@sha256:5e9650300a1a37174834b2528a7e2f0d40511016b55aca47bd65bb0396be7ccb
             resources:
               limits:
                 memory: 512Mi
               requests:
                 cpu: 10m
                 memory: 128Mi

[mortyops]

--- HelmRelease: selfhosted/changedetection Deployment: selfhosted/changedetection

+++ HelmRelease: selfhosted/changedetection Deployment: selfhosted/changedetection

@@ -68,13 +68,13 @@

         - name: PLAYWRIGHT_DRIVER_URL
           value: ws://localhost:3000/?stealth=1&--disable-web-security=true&--user-data-dir=~/browserless-cache-123
         - name: PORT
           value: '5000'
         - name: USE_X_SETTINGS
           value: '1'
-        image: ghcr.io/dgtlmoon/changedetection.io:0.52.9@sha256:e95931043d68da46e90498ce74ad317b392caade07186dc06bdfa1710901bf90
+        image: ghcr.io/dgtlmoon/changedetection.io:0.54.3@sha256:5e9650300a1a37174834b2528a7e2f0d40511016b55aca47bd65bb0396be7ccb
         name: main
         resources:
           limits:
             memory: 512Mi
           requests:
             cpu: 10m