v0.346.1: SECURITY — traefik v3.7.16, the file manager 1.5.8-stable, cloudflared 2026.10.4 (felhom.eu R-1304, R-1305); test TestEnsureTraefik_ANewImageRecreatesTraefik (red first)

Built from the v0.346.0 release commit b1b9be3 + this one commit. MinAgent 0.158.1 (unchanged).

controller/internal/infra/infra.go

@@ -22,11 +22,15 @@ import (
 // Pinned image tags — NEVER ":latest" (a floating tag breaks reproducible golden bakes and lets the
 // deployed version drift). Verified to resolve on Docker Hub before baking. cloudflared follows Cloudflare's security
 // notices (felhom.eu `01` „Tunnel placement"): 2026.10.3 since the notice of 2026-10-20 — before 2026.10.2 the image
-// trusts eight eMudhra (emSign) intermediates with weak keys.
+// trusts eight eMudhra (emSign) intermediates with weak keys; 2026.10.4 since 2026-10-27 (VULN-176088, the metrics
+// server's debug endpoints). traefik v3.7.16 and the file manager 1.5.8-stable since 2026-10-27 for their security
+// notices (felhom.eu R-1304, R-1305; 1.5.7-stable is skipped — it broke existing TOTP sign-ins). Each new image reaches
+// a running box by the reconcile at start: TestEnsureTraefik_ANewImageRecreatesTraefik,
+// TestEnsureCloudflared_ANewImageRecreatesTheTunnel, TestReconcileFileBrowserImage_MovesOnlyTheImage.
 const (
-	TraefikImage     = "traefik:v3.7.13"
-	CloudflaredImage = "cloudflare/cloudflared:2026.10.3"
-	FileBrowserImage = "gtstef/filebrowser:1.5.6-stable"
+	TraefikImage     = "traefik:v3.7.16"
+	CloudflaredImage = "cloudflare/cloudflared:2026.10.4"
+	FileBrowserImage = "gtstef/filebrowser:1.5.8-stable"
 	// FileBrowserImportMount is the in-container mount point NAME for the canonical drop-zone
 	// (R-75): the bind lands at /srv/<this>. ASCII and space-free on purpose — it appears in a
 	// container path, in the generated compose, and (percent-encoded) in the deep-link URL.