[truecharts-admin]

This PR contains the following updates:

Package	Update	Change
Kometa-Team/Kometa	patch	2.5.4 → 2.5.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Kometa-Team/Kometa

v2.5.5

Compare Source

Removed

• linux/arm/v7 (32-bit ARM) Docker images are no longer published. v2.5.4 is the final release with armv7 images; 32-bit ARM users should pin kometateam/kometa:v2.5.4.

Fixed

• Suppress unverified HTTPS warnings for the configured Plex host when its SSL verification is disabled, while preserving warnings for other hosts. #​3743
• Avoid warnings when Tautulli builders omit the optional list_minimum or explicitly set it to its default of 0.
• Warn and ignore missing collection names in collection.not post-filters instead of rejecting the definition, allowing overlays to continue after an excluded collection is deleted.
• Preserve IMDb show mappings when TMDb cannot provide a TVDb ID, allowing metadata files to match those shows by IMDb ID. #​3820
• Avoid warning about a missing optional sort_by when Letterboxd user-page builders use the default sort. #​3814
• Reject items without a release or first-air date when applying numeric tmdb_year filters instead of aborting missing-item processing. #​3815
• Apply IMDb keyword filters to missing movies and shows before reporting them or sending them to Radarr/Sonarr. #​3816
• Process YAML files from folder sources in alphabetical filename order, ignoring case, instead of filesystem order.
• Redact sensitive fallback defaults before logging library connection warnings, preventing inherited Sonarr/Radarr API keys from appearing in logs. #​3839
• Abort existing collection processing when a builder fails to fetch its items, preserving membership instead of syncing incomplete results. #​3838
• Skip Letterboxd TV entries with a single warning instead of also logging a failed movie lookup as an error. #​3836
• Accept Tracearr display names in builder user options, report identity UUIDs for ambiguous names, and validate Public API v2 response handling against the Tracearr 3.1.2 contract.
• Discover dynamic collection keys across the full library on scoped schedule runs, avoiding empty actor discovery even when collection files are scheduled out. #​3846
• Let Docker containers recreated from an older image keep starting after an update instead of failing with ModuleNotFoundError: No module named 'packaging'. #​3692

Added

• Added mdblist_watchlist builder to create collections based on watchlist
• Recognize TMDb and IMDb identifiers embedded in Plex NFO Movie agent GUIDs when mapping movie libraries. #​3837

Changed

• Allow items(plex:<ratingKey>|...) schedule scopes to target individual Plex items, including seasons and episodes, during library operations and overlay updates. Behavior remains the same when other ID types are used (TMDb, TVDb, IMDb).

Docs

• Tell Docker users to recreate the container when updating instead of updating it in place or copying an old container's Entrypoint or PATH, which can stop a newer image starting with ModuleNotFoundError: No module named 'packaging'. #​3692

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

• Updates
  • Updated Kometa from version 2.5.4 to 2.5.5. This release contains a version update only; no additional user-facing changes are noted.

The Kometa Docker Bake configuration now sets the default VERSION to 2.5.5 instead of 2.5.4.

Changes: Kometa version update

Layer / File(s)	Summary
Update version default apps/kometa/docker-bake.hcl	The default VERSION changes from 2.5.4 to 2.5.5.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested labels: area/apps

Merge Risk: Minimal · up to a3dfe

This is a routine Kometa version bump with no identified regression risk. The image build keeps the same source and installation steps. The existing container test covers the expected artifact.

Security architecture risk: Low · up to a3dfe

The update preserves the existing source location, build privileges, and runtime user. No introduced or worsened security condition was established. The selected release’s contents and authenticity were not independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The evidenced trust exposure is the Kometa image build and images containing the selected release. Upstream source and dependency integrity matter because installation occurs with build-time root authority. The available evidence does not establish downstream tenant, credential, or deployment exposure.

Trust Boundaries and Controls

• observed — The archive fetch uses HTTPS and a fixed repository location, but the inspected Dockerfile has no explicit archive checksum or signature check before extraction and installation. This trust assumption predates the PR; no changed source-selection authority or verification control was established.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[trueforge-bot]

📦 App Size Analysis

Note

Comparing ghcr.io/trueforge-org/kometa:rolling ➔ ghcr.io/trueforge-org/kometa:sandbox

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	604.27 MB	608.44 MB	+4.17 MB (+0.69%)	🔼
linux/arm64	592.41 MB	596.54 MB	+4.13 MB (+0.7%)	🔼

[Crow-Control]

Auto approved automated PR