[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/manios/nagios (source)	major	build-37 → build-38

---

Release Notes

manios/docker-nagios (docker.io/manios/nagios)

vbuild-38

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the build-37 → build-38 Nagios image update unchanged. It changes only the image tag and integrates directly with the recorded target; no compatibility fix was identified. Local PHP/frontend checks, audits, build and peer checks passed; isolated application-generated Nagios configuration validated with zero errors and one fixture-only missing-contact warning. Remote NRPE/TLS interoperability and production custom plugins remain untested.

Agent-assessed risk: Medium. The monitoring runtime and NRPE client change; isolated validation passes, but deployed agents, TLS policies and custom plugins were not exercised.

Evidence (10 items)

• Local check: git diff ee5e8d0f5b218418a745c507e89c4219f601a0d5...refs/artidezi/inputs/source-pr; git merge-base ee5e8d0f5b218418a745c507e89c4219f601a0d5 refs/artidezi/inputs/source-pr; git diff --check; git status --porcelain — Merge base equals target. Sole change is compose.yml image build-37 to build-38; no target-only changes. Diff check passed and checkout remains clean and unchanged.
• Upstream diff: source — Only CHANGELOG.md and Dockerfile change. Dockerfile updates NRPE_VERSION 4.1.3 to 4.2.0 and build labels. No entrypoint, mount, user or path changes.
• Changelog: source — Lists unchanged Core 4.5.14/plugins 2.5.0, NRPE 4.2.0 and Alpine 3.24.3. Reports PHP 8.3.36 security fixes; linked advisory GHSA-r5x2-327c-wjf6 returned 404, so specific CVE claims were not independently corroborated.
• Changelog: source — Lists optional IPv4/IPv6 and SSL/TLS controls and fixes. Also reviewed official comparison API src/check_nrpe.c and src/nrpe-ssl.c: existing -H/-p/-t/-c options remain supported. Network I/O/error handling changes, including SSL connection failures returning UNKNOWN; remote agent interoperability was not exercised.
• Local check: docker pull docker.io/manios/nagios:build-38; docker run --rm --network none --entrypoint /bin/sh docker.io/manios/nagios:build-38 (version, id and plugin probes) — Pulled digest sha256:908021c4a5b6f304159eb5fbbf5198f1bc7190e7790ee446b7a8c7e864589618. Confirmed Core 4.5.14, NRPE 4.2.0, PHP via php83 8.3.36, nagios UID:GID 100:101, nslookup/curl and executable seed-command plugins check_dummy/dns/nrpe/http/tcp/udp/ping/imap/smtp/ftp. check_dummy 0 fixture returned OK. No monitoring daemon or normal entrypoint started.
• Local check: mkdir -p var/composer-cache; ./bin/composer install --no-interaction --prefer-dist; ./bin/composer validate --strict; ./bin/composer audit --locked; docker build --iidfile /tmp/artidezi-php-image.id etc/docker/php — All passed. Composer manifest valid, no vulnerability advisories, dependencies installed. Actual PHP image reports PHP 8.5.12/MongoDB driver 2.5.5 and loads installed dependencies successfully. Docker build reused cached layers.
• Local check: docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/artidezi-php-image.id)" -ec 'vendor/bin/phpstan analyse -c phpstan.neon && vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php && vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php' — Passed: PHPStan no errors; PHP CS Fixer 146 files, none needing fixes; Twig 38 files, zero notices/warnings/errors. CS Fixer emitted informational PHP 8.5 runtime versus minimum PHP 8.4 warning.
• Local check: just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit && cd /app && npm ls --all >/tmp/npm-ls.log && echo "Installed dependency tree and peer dependencies: OK"' — ESLint, tsc --noEmit, asset build, npm audit and installed dependency/peer checks passed. Initial npm ls from /app/src failed because helper dependencies are installed at /app/node_modules; corrected /app check passed. Generated assets/dependencies remain ignored. Browser exercise omitted because frontend loading and asset paths are unchanged.
• Local check: Generate fixture with PHP autoload/InternalConfigurationExporter/ConfigurationFile/ObjectDefinition/ConfigurationWriter; docker run --rm --network none --mount type=bind,src=/tmp/artidezi-nagios-fixture,dst=/nagadmin-generated-config,readonly --entrypoint /bin/sh docker.io/manios/nagios:build-38 -ec 'mkdir -p /opt/nagios/var/spool/checkresults; /opt/nagios/bin/nagios -v /nagadmin-generated-config/nagios.cfg' — Passed with zero errors and one warning: synthetic host has no contacts/contactgroups. Fixture uses tracked nagios.cfg.dist, real internal exporter output, all command seed definitions, synthetic host/NRPE service and isolated resource macros. Inspected cgi.cfg.dist paths, Compose mounts and exporter plugin paths. No database, deployment env files, notifications or live stack used. Deployment-specific configuration, remote TLS and custom plugins remain untested.
• Evidence: Provided source CI snapshot for 93304b9317ea2ea7b96de3025a20b730609a3292 — Reports successful frontend/php checks; controller independently refreshes forge gates.

Assessed source 93304b9317ea2ea7b96de3025a20b730609a3292.