fix(container): update image ghcr.io/home-operations/sonarr (4.0.18.2978 ➔ 4.0.19.2991)

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/sonarr (source)	patch	4.0.18.2978 → 4.0.19.2991

---

Release Notes

Sonarr/Sonarr (ghcr.io/home-operations/sonarr)

v4.0.19.2991: 4.0.19.2991

Compare Source

What's Changed

Changes

• Fixed: Unexpected languages stored in DB will be treated as Unknown by @​mynameisbogdan in #​8810

Full Changelog: Sonarr/Sonarr@v4.0.18.2978...v4.0.19.2991

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated Sonarr to a newer container release, bringing the application to version 4.0.19.2991.

[tanguille-cluster]

@@ spec.template.spec.containers.app.image @@
# apps/v1/Deployment/media/sonarr
! ± value change
- ghcr.io/home-operations/sonarr:4.0.18.2978@sha256:2cd77fb3d81909a734d61bb8f71462044cb9d2f187e626a28a05a5c4e4be8fd2
+ ghcr.io/home-operations/sonarr:4.0.19.2991@sha256:f9dec0cf69a45b16c698ef2a25fe6c70ff4ec8d0b2315897c0d48b3b5a456c87

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a29b8ed-57f1-4215-9cbd-2d3cb0da5547

📥 Commits

Reviewing files that changed from the base of the PR and between 70006c1 and be5044d.

📒 Files selected for processing (1)

• kubernetes/apps/media/sonarr/app/helmrelease.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• Tanguille/LLMKube (auto-detected)

---

📝 Walkthrough

Walkthrough

The Sonarr HelmRelease now references container image version 4.0.19.2991 with its corresponding SHA256 digest. Other deployment configuration remains unchanged.

Changes

Sonarr image update

Layer / File(s)	Summary
Update Sonarr image pin kubernetes/apps/media/sonarr/app/helmrelease.yaml	The pinned Sonarr container image tag and digest are updated from 4.0.18.2978 to 4.0.19.2991.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Tanguille/cluster#4168: Updates a HelmRelease container image tag and digest using the same image-bump pattern.

Suggested labels: area/kubernetes, renovate/container, type/patch

Suggested reviewers: tanguille

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the Sonarr container image version update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/ghcr.io-home-operations-sonarr-4.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[tanguille-cluster]

@@ spec.values.controllers.sonarr.containers.app.image.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/media/sonarr
! ± value change
- 4.0.18.2978@sha256:2cd77fb3d81909a734d61bb8f71462044cb9d2f187e626a28a05a5c4e4be8fd2
+ 4.0.19.2991@sha256:f9dec0cf69a45b16c698ef2a25fe6c70ff4ec8d0b2315897c0d48b3b5a456c87

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation

Approve. This is a straightforward patch-level image update for Sonarr (4.0.18.2978 → 4.0.19.2991) with no manifest, resource, or configuration changes beyond the image tag and digest.

Change-by-Change Findings

kubernetes/apps/media/sonarr/app/helmrelease.yaml

• Updated image from ghcr.io/home-operations/sonarr:4.0.18.2978 to ghcr.io/home-operations/sonarr:4.0.19.2991 with matching SHA256 digest. No other fields changed.
• Resource requests/limits remain unchanged (cpu: 100m–2, memory: 256Mi–1Gi).
• Security context (readOnlyRootFilesystem, allowPrivilegeEscalation: false, capabilities dropped) unchanged.
• Probe paths (/ping) and port configuration unchanged.
• No file-serving path or directory traversal surface was modified; the route uses an internal HTTPRoute parentRef (envoy-internal) with no filesystem-exposing endpoints added.

Release Notes

Sonarr v4.0.19.2991 includes:

• Bug fix: Unexpected languages stored in the database are now treated as Unknown instead of causing parsing errors. This also adds null-handling in the language JSON converter.
• Additional upstream commits in this range include a fix for excluding streaming extensions during media info probing and a malformed cookie test correction — all non-breaking bug fixes.
• No breaking changes or security advisories reported for this release.

Full changelog: https://github.com/Sonarr/Sonarr/releases/tag/v4.0.19.2991

Standards Compliance

• Follows repository conventions: uses app-template chart via OCIRepository reference, YAML anchors for DRY patterns, SOPS-managed secrets via secretRef, and internal HTTPRoute routing through envoy-internal.
• Image uses pinned digest (@sha256:...), consistent with cluster standards.
• Commit title follows Conventional Commits format (fix(container): ...).

Must-Check Items

Check	Status
Validate manifest against target cluster version	✅ Passes schema (helm.toolkit.fluxcd.io/v2); no API version changes.
Check for resource quota / limit changes	✅ No resource changes; requests and limits unchanged.
Verify file path sanitization	✅ Not applicable — no user-controlled file paths introduced; persistence uses existing PVC.
Check for directory traversal vulnerabilities	✅ Not applicable — no new file-serving endpoints or path-based routing added.

Unknowns or Needs Verification

• The home-operations/sonarr container image is a third-party build wrapping the official Sonarr application. I verified the upstream Sonarr release notes but did not independently verify the home-operations Dockerfile or build provenance. This is consistent with how other apps in this repo use ghcr.io/home-operations/* images, so it is noted but not blocking.