feat(container): update image ghcr.io/autobrr/qui (v1.24.0 ➔ v1.25.0)

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/autobrr/qui	minor	v1.24.0 → v1.25.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

autobrr/qui (ghcr.io/autobrr/qui)

v1.25.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Qui HelmRelease updates its container image from v1.24.0 to v1.25.0 and changes the pinned SHA256 digest.

Changes

Qui image update

Layer / File(s)	Summary
Update Qui image reference kubernetes/apps/media/qui/app/helmrelease.yaml	The HelmRelease now references Qui v1.25.0 with its new pinned SHA256 digest.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Tanguille/cluster#4261: Updates the same ghcr.io/autobrr/qui image in the same helmrelease.yaml.

Suggested reviewers: tanguille

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Qui container image and the version update from v1.24.0 to v1.25.0.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/ghcr.io-autobrr-qui-1.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[tanguille-cluster]

@@ spec.template.spec.containers.app.image @@
# apps/v1/Deployment/media/qui
! ± value change
- ghcr.io/autobrr/qui:v1.24.0@sha256:c1531b69a116b2572f69c76e6e02990b20ca04ef6550c883009df9ebcade1aba
+ ghcr.io/autobrr/qui:v1.25.0@sha256:3285c52f0258645d1d5a1684e25596c7355ef525363f0f9464d1c7b2cad14be8

[tanguille-cluster]

@@ spec.values.controllers.qui.containers.app.image.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/media/qui
! ± value change
- v1.24.0@sha256:c1531b69a116b2572f69c76e6e02990b20ca04ef6550c883009df9ebcade1aba
+ v1.25.0@sha256:3285c52f0258645d1d5a1684e25596c7355ef525363f0f9464d1c7b2cad14be8

[github-actions]

AI Automated Review

Analysis engine: omniroute@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Approve

This is a routine Renovate container image bump for the qui (qBittorrent web UI) application, updating from v1.24.0 to v1.25.0. The change is a single-line tag/digest update in the HelmRelease manifest with no other modifications.

Change-by-Change Findings

kubernetes/apps/media/qui/app/helmrelease.yaml — Image tag updated from v1.24.0@sha256:c1531b69... to v1.25.0@sha256:3285c52f.... The digest is pinned, which is consistent with repository practice. No other values, resources, probes, security contexts, or routes were modified.

Release Notes

v1.25.0 (minor bump, 37 commits since v1.24.0):

• New features: Crossseed improvements including season pack assembly from seeded episodes, RSS feed paging, byte-based auto-resume rule replacing percentage-based, per-indexer seeded search history, saved filter views, arrow-key navigation in the torrent list, and remembering Prowlarr/Jackett connections in the discover dialog.
• Bug fixes: Crossseed title matching fixes (punctuation scene naming, one-sided HDR/collection tags, exact-size pairing), season structure recovery from files/metainfo, dirscan reopening of no_match files when new indexers appear, torznab rate-limit handling and structured season/ep param preservation, web UI fixes (overlay blur scoping, keyboard shortcut hijacking), and logging diagnostic level change (DEBUG replaces TRACE as the supported level).
• No breaking changes or security fixes are listed in the release notes.

Must-Check Items

1. Validate manifest against target cluster version — The manifest uses helm.toolkit.fluxcd.io/v2 (unchanged) and the app-template chart (unchanged). No API version changes. The image bump does not affect cluster compatibility.
2. Check for resource quota / limit changes — No resource changes in this PR. Requests (10m CPU / 128Mi memory) and limits (2 CPU / 2Gi memory) remain unchanged.
3. Verify file path sanitization — No file path handling is modified by this change. The manifest does not define any file-serving configuration; the app's internal file handling is not affected by a version bump.
4. Check for directory traversal vulnerabilities — No code or configuration changes that could introduce traversal issues. The manifest only updates the container image tag; the app's web server behavior is governed by the upstream release, which lists no security fixes or traversal-related changes.

Standards Compliance

• The change follows the repository's established Renovate container update pattern (consistent with prior qui bumps in git history: v1.23.0→v1.24.0, v1.22.0→v1.23.0, etc.).
• The image digest is pinned, matching the repo's convention for container images.
• Conventional Commit title is used (feat(container): update image ...).
• No shell scripts, SOPS secrets, or cluster-applying operations are involved.

Tool Harness Findings

No tool harness findings were supplied.

Unknowns or Needs Verification

• The PR body's embedded release notes were empty (only a compare link); the release notes above were retrieved from the upstream GitHub release API for v1.25.0. The digest sha256:3285c52f... was not independently verified against the upstream image registry in this review.
• The qui app runs with QUI__AUTH_DISABLED: true and an explicit acknowledgement flag; this is pre-existing configuration, not introduced by this PR, and the route is internal-only (envoy-internal parentRef). No change in exposure is introduced.

[deepsource-io]

DeepSource Code Review

We reviewed changes in faea67e...1c6954e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 5, 2026 8:02p.m.	Review ↗
Shell		Aug 5, 2026 8:02p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.