Full Dependency Survey & Upgrade Plan (2026-06-15)

Full Dependency Survey & Upgrade Plan

Snapshot date: 2026-06-15. Versions verified against live release pages / registries within ~2 weeks of this date. Re-verify before executing any wave — this is a moving target and self-hosted Renovate will have closed several gaps automatically by the time you act.

Goal: Catalog every pinned dependency across all seven planes (Helm/images, Terraform, Ansible/k3s, Python, Node, GitHub Actions, base images), diff against current GA, score upgrade risk, and sequence the safe path to current.

Executive summary

Plane	Items	At/near latest	Behind (actionable)	HIGH-risk items
Helm charts	31	~13	~18	6
Container images	28	~6	~11	3
Terraform providers	11	9	2	0
k3s + CNI + node binaries	9	1	8	1 (k3s unpinned)
Ansible collections	8	1	7	7 (open floors)
Python	19	~14	~5	0
Node (website)	7	7	0	0
GitHub Actions	13	most	2 stale	supply-chain (all)
Base images / CI bins	5	2	3	0

Three structural findings drive the whole plan (Renovate handles routine minor/patch automerge, so human effort goes here):

Open >= floors silently admit breaking majors. 7 of 8 Ansible collections have a GA major published above an unbounded floor — a fresh ansible-galaxy install pulls a major the floor never validated against. Same risk class: k3s_version: "" floats to whatever stable resolves at install time.
Supply-chain exposure on moving tags. Every GitHub Action is pinned to a moving tag, not a 40-char SHA — including tj-actions/changed-files, which was retroactively poisoned in the 2025 CVE-2025-30066 compromise.
Repo migrations a version bump can’t follow. Loki (OSS forked off grafana/loki at 6.55.0 → grafana-community), grafana-mcp (→ grafana-community), and ClickStack (hyperdxio archived → ClickHouse org) all moved homes. Bumping targetRevision chases a dead/wrong chart.

Wave 0 — Safety pins (do first; low effort, removes silent-breakage risk)

These are not version upgrades — they’re closing footguns where current config can break on the next unrelated install/rebuild.

Pin k3s. Set k3s_version: v1.36.0+k3s1 in ansible/roles/k3s-common/defaults/main.yml. Floating "" allows uncontrolled K8s-minor jumps (1.35→1.36 = API removals, one-way etcd migration) and node skew between hosts provisioned weeks apart. (Highest single risk in the repo.) Done (hl-onvz.1): pinned to v1.36.0+k3s1 — the version all 8 nodes already run at execution time — not the survey-time stable v1.35.5+k3s1, which would have set an install floor below the running cluster.
Ceiling-pin 7 Ansible collections in ansible/requirements.yml (>=X,<X+1): community.general (13 GA), community.hashi_vault (7 GA), ansible.posix (2 GA), ansible.netcommon (8 GA), ansible.utils (6 GA), community.docker (5 GA), community.sops (2 GA). community.general 13 and hashi_vault 7 both raised their ansible-core floor — pull is breaking.
SHA-pin tj-actions/changed-files (pr-review.yml, 2 uses) to a 40-char SHA with # v47.0.6 comment. Compromise history — do this one first.
Pin browserless/chrome (karakeep/browserless.yaml) off :latest. DockerHub :latest tracks deprecated v1; any rebuild can silently jump. Pin an explicit tag (and plan v1→v2/GHCR migration separately — breaking rewrite).
dolt 2.0.1 → 2.1.x (dolt/statefulset.yaml). 2.0.1 has a TEXT/BLOB ALTER TABLE data-corruption bug fixed in 2.1.0. In-place safe, no dolt migrate. Security/correctness, not a feature bump.
Pin rancher/k3s-upgrade plans (system-upgrade) to match the chosen k3s version. Done (hl-onvz.1): pinned both Plan images to rancher/k3s-upgrade:v1.36.0-k3s1 (off the implicit moving :latest); spec.version already at v1.36.0+k3s1.

Wave 1 — Security & safe patch/minor (mostly Renovate-automergeable; verify it fired)

Low blast radius, in-place safe. If Renovate is healthy these largely land on their own — this wave is the manual sweep for anything it parked.

grafana-operator 5.22.2 → 5.24.0 — 5.24.0 is a security fix. Manually kubectl apply --server-side --force-conflicts the v5.24.0 CRDs (Helm won’t upgrade CRDs; backward-compatible).
mealie v3.17.0 → v3.19.1 — security fixes (query-filter SSRF). No data migration.
tandoor (recipes) 2.6.1 → 2.6.9 — XSS/security CVE patches, same 2.6 line, forward-only Django migrations auto-apply.
reloader 2.2.11 → 2.2.12, velero 12.0.1 → 12.0.3, cloudnative-pg 0.28.0 → 0.28.3 — pure patch, no CRD/schema change.
vault chart 0.32.0 → 0.33.0 — pins default app image to Vault v2.0.2; pin the image explicitly if you don’t want the implicit app jump.
cilium 1.19.3 → latest 1.19.x patch — LOW. Do NOT jump to 1.20 (not GA — only 1.20.0-pre.3).
alpine 3.24 → 3.24.1 (floating tag already picks up the OpenSSL fix), tfc-agent 1.28.8 → 1.28.12, nats-box 0.19.5 → 0.19.7, cloudflared 2026.3.0 → 2026.6.0, ruff/pytest patch bumps.
actions-runner 2.330.0 → 2.335.1, openclaw 2026.2.1 → 2026.6.6 (pin a digest, not :latest — issue #24607 documents :latest unreliability), rumdl v0.2.8 → v0.2.9.

Wave 2 — Repo migrations (NOT a version bump — source change required)

Each needs the chart repoURL/source repointed, then values diffed. A targetRevision bump alone is wrong.

Loki 7.0.0 → migrate OSS path to grafana-community/helm-charts. grafana/loki is now GEL-only; OSS was forked at chart 6.55.0. Staying on 7.0.0 in the grafana repo = unmaintained GEL release. Repoint, then pick the current grafana-community OSS chart. (Also: 7.0.0 swapped bundled MinIO to the Pigsty fork for a CVE.)
grafana-mcp 0.3.1 → grafana-community/grafana-mcp 0.16.0. Old grafana/grafana-mcp deprecated (updates stopped Jan 30 2026). Repoint + diff values across ~13 pre-1.0 minors.
ClickStack 2.1.1 → 3.0.0 (already on the ClickHouse-org chart — good). Major boundary: confirm clickstack-operators (CRDs) still pairs at 1.0.0, two-phase install order (operators first), diff values. 3.0.0 ships no release-notes body — treat as breaking.

Wave 3 — MED-risk minors (config-schema review per item; mostly stateless)

Wave 4 — HIGH-risk / stateful migrations (plan each as its own change with rollback)

These are not Renovate-automergeable and not “bump and pray.” Each warrants its own spec/runbook + maintenance window.

kube-prometheus-stack 84.5.0 → 86.2.3 (2 majors). 84→85: default distroless prometheus/node-exporter images (sync -distroless tags if mirroring). 85→86: Prometheus-Operator v0.91.0 — kubectl apply --server-side the v0.91.0 monitoring.coreos.com CRDs before upgrade (or crds.upgradeJob.enabled). Bundles Grafana 13.
temporal chart 0.73.1 → 1.2.0 (0.x→1.x GA). Values.yaml restructured; stateful orchestrator + DB schema-version compatibility → treat as a migration with DB schema checks, not in-place.
temporal-worker-controller chart 0.11.0 → 0.26.0 (app →v1.7.0). Two hard breaks: CRD renames (TemporalWorkerDeployment→WorkerDeployment, TemporalConnection→Connection) and a CRD-chart split (v1.4.0). Staged path: chart 0.20.0 (app v1.3.1) first, then one minor at a time. authProxy.enabled → metrics.disableAuth. Highest-complexity migration in the set.
meilisearch v1.14 → v1.46 (~32 minors, karakeep). Version-locked on-disk format — use dump / --import-dump; expect client changes. Consider intermediate hops.
clickhouse-server 25.7 → 26.3-alpine (LTS) (major 25→26). One-way: parts written by 26.x are unreadable by 25.x (downgrade = data loss). Auto-migrates forward via background merges but set compatibility=25.7 + rolling restart; target LTS 26.3, not 26.5.

Decisions required (not mechanical — need a call)

agentgateway 1.3.0-alpha.1 running in prod. No GA 1.3.0 exists (only beta). Decide: pin to GA 1.2.x stable, or accept alpha. Also re-verify the chart path (canonical may be cr.agentgateway.dev/charts/agentgateway).
Calico v3.30.0 in tp_cluster_nodes.yml — appears to be dead code under Cilium. Confirm unused and remove the manifests rather than upgrade to v3.32.
ansible (py) 13.7.x → 14.0.0 — bundles ansible-core ~2.21 (crosses 2.19/2.20/2.21). Deliberate major; coordinate with collection ceiling pins from Wave 0.
astro 7 / starlight 1.0 — no GA yet (astro 7 only beta; starlight still 0.40.0). Defer; a future astro 7 GA forces a coordinated starlight + 2-plugin bump (peer ranges cap at astro 6).
authentik TF provider ~> 2025.12 → 2026.5.x — CalVer; must move in lockstep with the deployed Authentik server version, not independently. (Server already on 2026.5.x per recent PRs.)
cryptography 48 → 49 — fine for Linux cluster runtime (ships cp314 wheels), but drops macOS x86_64 prebuilt wheels — flag for any Intel-Mac developers before bumping. Confirm transitive markupsafe >=3.0.3 for 3.14.

Coupling constraints (don’t bump in isolation)

velero-plugin-for-aws minor MUST match Velero server minor (plugin v1.13.x ↔ Velero v1.17.x). Bumping the plugin alone breaks backup/restore.
temporal server / worker-controller / workers move together (schema + CRD compatibility).
cilium 1.20 ⟷ Gateway API v1.5 ⟷ TLSRoute v1 — sequence as one change when 1.20 reaches GA (migrate TLSRoute v1alpha2→v1 first).
kube-prometheus-stack CRDs and grafana-operator/tailscale-operator/temporal-worker-controller CRDs require manual kubectl apply --server-side — Helm never upgrades CRDs.

What’s already current (no action)

authentik chart, clickstack-operators, gha-runner-scale-set/ARC, hcp-terraform-operator, mend-renovate-ce, traefik(+crds), all HashiCorp TF providers (no v6 vault / no v4 k8s+helm GA), grafana/random/tfe/uptimekuma providers, Terraform core ~> 1.15, kubernetes.core, mosquitto, karakeep, uptime-kuma, miniflux, traefik/whoami, mongo (on 8.0 track), and the entire Node/website stack + most Python runtime deps.

Execution notes

Let Renovate drain Wave 1 first. Re-run this survey after a Renovate cycle; many LOW items will already be merged, shrinking the manual list.
One PR per wave item for Wave 3–4; Wave 0–2 can batch by plane.
CRD-bearing charts: always kubectl apply --server-side --force-conflicts the new CRDs before the Helm/ArgoCD sync.
Stateful (Wave 4): snapshot/backup → upgrade → verify, each with a written rollback. clickhouse and meilisearch are one-way — no rollback once data is written by the new version.