fix(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
axllent/mailpit (source)		minor	v1.26 → v1.30
libops/base		digest	0c6bab5 → c352cf6
libops/mariadb		digest	1b0f53f → e629d8d
libops/wp	final	digest	f98f7c1 → cb111e4
roots/wordpress (source)	require	patch	6.9.4 → 6.9.5
traefik		patch	v3.7.5 → v3.7.8
vlucas/phpdotenv	require	patch	5.6.3 → 5.6.4
wpackagist-plugin/akismet (source)	require	minor	5.6 → 5.7
wpackagist-plugin/wordpress-seo (source)	require	minor	27.3 → 27.9
wpackagist-theme/twentyeleven (source)	require	minor	5.0 → 5.1
wpackagist-theme/twentyfifteen (source)	require	minor	4.1 → 4.2
wpackagist-theme/twentyfourteen (source)	require	minor	4.4 → 4.5
wpackagist-theme/twentynineteen (source)	require	minor	3.2 → 3.3
wpackagist-theme/twentyseventeen (source)	require	minor	4.0 → 4.1
wpackagist-theme/twentysixteen (source)	require	minor	3.7 → 3.8
wpackagist-theme/twentyten (source)	require	minor	4.5 → 4.6
wpackagist-theme/twentythirteen (source)	require	minor	4.5 → 4.6
wpackagist-theme/twentytwelve (source)	require	minor	4.7 → 4.8
wpackagist-theme/twentytwenty (source)	require	minor	3.0 → 3.1
wpackagist-theme/twentytwentyfour (source)	require	minor	1.4 → 1.5
wpackagist-theme/twentytwentyone (source)	require	minor	2.7 → 2.8

---

Release Notes

axllent/mailpit (axllent/mailpit)

v1.30

Security

• Reject oversized image dimensions in thumbnail handler before full decode (GHSA-75mr-qw9x-3r39)
• Enforce command line length limits in SMTP and POP3 handlers (GHSA-w878-pj84-3j5v)

Chore

• Update Github Actions
• Refactor browser storage settings for consistency (#​715)
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update Github Action requirements

Fix

• Exclude supported clients in HTML check results (#​716)

v1.29

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies

v1.28

Chore

• Increase allowed SMTP email address length to 1024 chars & return clearer SMTP responses for failures (#​620)
• Update Go dependencies
• Update node dependencies

Fix

• Ensure SMTP HELO/EHLO command is issued before MAIL FROM as per RFC 5321 (#​621)
• Prevent nested MAIL command during an active SMTP transaction (#​623)
• Avoid error on image type assertion in thumbnail generation

v1.27

Chore

• Update Go dependencies
• Update node dependencies
• Add type assertion for value in imaging assignment

roots/wordpress (roots/wordpress)

v6.9.5

Compare Source

containous/traefik (traefik)

v3.7.8

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

v3.7.8

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

v3.7.7

Compare Source

Important: Please read the migration guide.

Bug fixes:

• [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#​13398 @​dfeinblatt)
• [rules] Fix consistency between HostSNI() and Host() (#​13460 @​juliens)
• [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace (#​13462 @​gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#​13399 @​amazon7737)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#​13458 @​gndz07)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#​13466 @​kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#​13477 @​rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#​13478 @​rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#​13481 @​kevinpollet)

Documentation:

• Fix version in migration guide (#​13434 @​kevinpollet)
• Fix changelog v2.11.51 (#​13430 @​mmatur)
• Add v3.7 to supported version docs (#​13118 @​jnoordsij)
• Fix some function names in comments (#​13443 @​blackflytech)
• Add @​nandorKollar as a current maintainer (#​13451 @​emilevauge)
• Add @​amazon7737 as a current maintainer (#​13450 @​emilevauge)
• [middleware] Clarify buffering middleware defaults (#​13401 @​amazon7737)
• Fix grammar in TLS, TCP service, and routing reference docs (#​13461 @​almightymoon)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#​13472 @​kevinpollet)

v3.7.7

Compare Source

Important: Please read the migration guide.

Bug fixes:

• [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#​13398 @​dfeinblatt)
• [rules] Fix consistency between HostSNI() and Host() (#​13460 @​juliens)
• [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace (#​13462 @​gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#​13399 @​amazon7737)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#​13458 @​gndz07)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#​13466 @​kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#​13477 @​rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#​13478 @​rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#​13481 @​kevinpollet)

Documentation:

• Fix version in migration guide (#​13434 @​kevinpollet)
• Fix changelog v2.11.51 (#​13430 @​mmatur)
• Add v3.7 to supported version docs (#​13118 @​jnoordsij)
• Fix some function names in comments (#​13443 @​blackflytech)
• Add @​nandorKollar as a current maintainer (#​13451 @​emilevauge)
• Add @​amazon7737 as a current maintainer (#​13450 @​emilevauge)
• [middleware] Clarify buffering middleware defaults (#​13401 @​amazon7737)
• Fix grammar in TLS, TCP service, and routing reference docs (#​13461 @​almightymoon)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#​13472 @​kevinpollet)

v3.7.6

Compare Source

All Commits

Bug fixes:

• [acme, logs] Bump github.com/go-acme/lego/v5 (#​13154 @​ldez)
• [acme] Bump github.com/go-acme/lego/v5 (#​13359 @​juliens)
• [k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates (#​13212 @​nickmnt)
• [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#​13356 @​AnatoleLucet)
• [k8s/gatewayapi] Avoid collisions for Gateway API services names (#​13367 @​rtribotte)
• [k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways (#​13397 @​rtribotte)
• [k8s/ingress-nginx] Configure retry according to buffering configuration (#​13039 @​rtribotte)
• [k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream (#​13386 @​carloslima)
• [k8s] Detect EndpointSlice condition changes (#​13405 @​kevinpollet)
• [k8s] Index Kubernetes EndpointSlice by service name (#​13395 @​kevinpollet)
• [k8s] Sort endpointslices to keep backend IPs consistent across rebuilds (#​13406 @​kevinpollet)
• [kv] Bump kvtools/redis to v1.2.1 (#​13403 @​ldez)
• [middleware, authentication] Fix x-forwarded-port in forward-auth (#​13344 @​juliens)
• [middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses (#​13360 @​AnatoleLucet)
• [middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier (#​12805 @​mihuross)
• [middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme (#​13347 @​gndz07)
• [middleware] Fix CORS Max-Age set to 0 by default (#​13371 @​AnatoleLucet)
• [middleware] Fix CORS wildcard when allow-credentials is true (#​13368 @​AnatoleLucet)
• [server] Add an option to remove request headers with underscores (#​13262 @​youkoulayley)
• [server] Configurable max request header size (#​13353 @​juliens)
• [tls] Fix nondeterministic TLS certificate selection on shared SAN (#​13348 @​rtribotte)
• [webui] Bump axios to v1.18.0 (#​13380 @​gndz07)
• [websocket] Fix connection upgrades when backend server is using h2c scheme (#​12967 @​stffabi)

Documentation:

• [k8s/crd] Fix broken CRD reference links in IngressRoute page (#​13375 @​s3onghyun)
• [k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation (#​13392 @​jnoordsij)
• [k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list (#​13372 @​nmengin)
• [k8s] Align Helm chart documented values with chart v41 (#​13366 @​mloiseleur)
• [middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers (#​13342 @​rtribotte)
• [middleware] Clarify entryPoint middleware reference format (#​13364 @​mloiseleur)
• [security] Add HTTP/2 header memory exhaustion security documentation (#​13381 @​emilevauge)
• Adds documentations on maxHeaderBytes (#​13363 @​juliens)
• Fix inaccuracies in reference documentation (#​13304 @​sheddy-traefik)

v3.7.6

Compare Source

All Commits

Bug fixes:

• [acme, logs] Bump github.com/go-acme/lego/v5 (#​13154 @​ldez)
• [acme] Bump github.com/go-acme/lego/v5 (#​13359 @​juliens)
• [k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates (#​13212 @​nickmnt)
• [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#​13356 @​AnatoleLucet)
• [k8s/gatewayapi] Avoid collisions for Gateway API services names (#​13367 @​rtribotte)
• [k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways (#​13397 @​rtribotte)
• [k8s/ingress-nginx] Configure retry according to buffering configuration (#​13039 @​rtribotte)
• [k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream (#​13386 @​carloslima)
• [k8s] Detect EndpointSlice condition changes (#​13405 @​kevinpollet)
• [k8s] Index Kubernetes EndpointSlice by service name (#​13395 @​kevinpollet)
• [k8s] Sort endpointslices to keep backend IPs consistent across rebuilds (#​13406 @​kevinpollet)
• [kv] Bump kvtools/redis to v1.2.1 (#​13403 @​ldez)
• [middleware, authentication] Fix x-forwarded-port in forward-auth (#​13344 @​juliens)
• [middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses (#​13360 @​AnatoleLucet)
• [middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier (#​12805 @​mihuross)
• [middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme (#​13347 @​gndz07)
• [middleware] Fix CORS Max-Age set to 0 by default (#​13371 @​AnatoleLucet)
• [middleware] Fix CORS wildcard when allow-credentials is true (#​13368 @​AnatoleLucet)
• [server] Add an option to remove request headers with underscores (#​13262 @​youkoulayley)
• [server] Configurable max request header size (#​13353 @​juliens)
• [tls] Fix nondeterministic TLS certificate selection on shared SAN (#​13348 @​rtribotte)
• [webui] Bump axios to v1.18.0 (#​13380 @​gndz07)
• [websocket] Fix connection upgrades when backend server is using h2c scheme (#​12967 @​stffabi)

Documentation:

• [k8s/crd] Fix broken CRD reference links in IngressRoute page (#​13375 @​s3onghyun)
• [k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation (#​13392 @​jnoordsij)
• [k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list (#​13372 @​nmengin)
• [k8s] Align Helm chart documented values with chart v41 (#​13366 @​mloiseleur)
• [middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers (#​13342 @​rtribotte)
• [middleware] Clarify entryPoint middleware reference format (#​13364 @​mloiseleur)
• [security] Add HTTP/2 header memory exhaustion security documentation (#​13381 @​emilevauge)
• Adds documentations on maxHeaderBytes (#​13363 @​juliens)
• Fix inaccuracies in reference documentation (#​13304 @​sheddy-traefik)

vlucas/phpdotenv (vlucas/phpdotenv)

v5.6.4: (06/07/2026)

Compare Source

We announce the immediate availability V5.6.4.

Changes

• Pass explicit trim characters ahead of PHP 8.6 (416df70)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.