v0.346.1: SECURITY — traefik v3.7.16, the file manager 1.5.8-stable, cloudflared 2026.10.4 (felhom.eu R-1304, R-1305); test TestEnsureTraefik_ANewImageRecreatesTraefik (red first)

Built from the v0.346.0 release commit b1b9be3 + this one commit. MinAgent 0.158.1 (unchanged).

controller/internal/stacks/infra_tunnel_test.go

@@ -162,6 +162,42 @@ func TestEnsureTraefik_ReconcilesARunningTraefik(t *testing.T) {
 	}
 }
 
+// A controller update that changes only traefik's IMAGE recreates the running traefik on the new image (the v3.7.16
+// security bump of 2026-10-27 rides this, felhom.eu R-1304: traefik.yml is unchanged, only the compose's `image:` line
+// moves). The control: the same render again is a no-op.
+func TestEnsureTraefik_ANewImageRecreatesTraefik(t *testing.T) {
+	state := stubDocker(t)
+	touch(t, filepath.Join(state, "running-traefik"), "")
+	m, calls := tunnelTestManager(t, "owner@example.com")
+	dir := t.TempDir()
+	cur, err := infra.RenderTraefik(infra.TraefikData{ACMEEmail: "owner@example.com", Tunnel: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := strings.Replace(cur["docker-compose.yml"].Content, "image: "+infra.TraefikImage, "image: traefik:v3.7.13", 1)
+	if old == cur["docker-compose.yml"].Content {
+		t.Fatal("the render has no `image:` line to age — the test would prove nothing")
+	}
+	for name, f := range cur {
+		touch(t, filepath.Join(dir, name), f.Content)
+	}
+	touch(t, filepath.Join(dir, "docker-compose.yml"), old)
+
+	if err := m.ensureTraefik(dir, true); err != nil {
+		t.Fatalf("ensureTraefik: %v", err)
+	}
+	cmp, _ := os.ReadFile(filepath.Join(dir, "docker-compose.yml"))
+	if !strings.Contains(string(cmp), "image: "+infra.TraefikImage) {
+		t.Fatalf("the compose must carry %s:\n%s", infra.TraefikImage, cmp)
+	}
+	if len(*calls) != 1 || (*calls)[0].args != "up -d --force-recreate" {
+		t.Fatalf("want ONE `up -d --force-recreate` (traefik on the new image), got %+v", *calls)
+	}
+	if err := m.ensureTraefik(dir, true); err != nil || len(*calls) != 1 {
+		t.Fatalf("an unchanged image must not recreate traefik again; err %v calls %+v", err, *calls)
+	}
+}
+
 // A rewrite that would DROP the certificate resolver the running file has is refused (no e-mail in the config).
 func TestEnsureTraefik_RefusesToDropTheCertResolver(t *testing.T) {
 	state := stubDocker(t)