Update ghcr.io/linuxserver/qbittorrent Docker tag to v5.2.1

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/linuxserver/qbittorrent (source)	minor	5.1.4 → 5.2.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 2am and before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

ghcr.io/linuxserver/qbittorrent (docker) 5.1.4 -> 5.2.1

Risk: 🟠 Breaking

The Deep Dive

Update Scope

#2181 changes only the qBittorrent deployment image in kubernetes/qbittorrent/deploy.yaml, moving ghcr.io/linuxserver/qbittorrent from 5.1.4@sha256:c9990949e968e99333f47f49da7d16e81ba6e1469c8c46807a65b984c9e8b6ff to 5.2.1@sha256:715d2bfbcf1cd3d734cbbd4fbd599eb7ea0642eaa079a372dd0d343f59516700. The app is directly pinned in the Deployment because kustomization.yaml only lists resources and has no images: override. The linuxserver image line also changes to static qBittorrent builds on Alpine 3.23 with libtorrent v2, while the local service shape stays the same: WebUI on 8080, BitTorrent TCP/UDP on 51414, /config PVC plus /downloads NFS, and no repo change to companion qBittorrent clients such as cross-seed, qbit_manage, or decluttarr.

Performance & Stability

• qBittorrent v5.2.0 improves resume queue load performance and avoids copying resume data when loading torrents, which is relevant because this deployment persists qBittorrent state in qbittorrent-config and exposes qBittorrent/BT_backup to automation through cross-seed and qbit_manage.
• qBittorrent v5.2.1 removes old-format lockfiles and deletes stale lockfiles on startup, which is relevant to a single-replica Kubernetes Deployment with persistent /config.
• qBittorrent v5.2.1 fixes retained WebAPI result payloads between calls, which is relevant because this deployment has qBittorrent WebAPI consumers in cross-seed, decluttarr, and qbit_manage.

Features & UX

• qBittorrent 5.2 adds WebAPI API-key authentication, with the key stored in Preferences/WebUI/APIKey and rotatable through app/rotateAPIKey. The repo currently uses username/password session login for decluttarr and the custom cross-seed cleanup script; API-key auth is a realistic migration path if the qBittorrent key is generated, stored in External Secrets, and clients send Authorization: Bearer <key> instead of using session cookies.

Security

• qBittorrent v5.2.1 fixes a high-level SSRF bug in HTTP redirection handling by rejecting redirected URL schemes outside http, https, and magnet. I found no published qBittorrent GitHub Security Advisory, so there is no public CVE ID or CVSS score to report; the fix still matters because this deployment exposes qBittorrent URL-fetching surfaces through the WebUI/API service on port 8080.

Newer Versions

• qBittorrent release-5.2.1 and linuxserver 5.2.1_v2.0.12-ls459 were the latest stable upstream releases found on 2026-05-26, so I found no newer stable version that fixes a regression introduced by this proposed version.

Hazards & Risks

• Breaking WebAPI login contract for the custom cleanup sidecar: qBittorrent 5.2 returns 204 for successful API calls with no response body and uses a session cookie name based on QBT_SID_<WebUI port>, while the deployed cross-seed cleanup script requires status 200, body Ok., and a SID= cookie. That script is run as the always-restarting cross-seed cleanup sidecar, so it will exit before the first sweep after qBittorrent is upgraded. Patch it before merge to accept any 2xx login response and preserve the returned QBT_SID_8080 cookie name, or migrate it to qBittorrent API-key auth.
• The stock qBittorrent clients are already on qBittorrent 5.2-compatible versions, but they do not fix the local script: cross-seed v6.13.7 accepts all 2xx qBittorrent login responses, qbit_manage v4.7.1 includes qBittorrent 5.2 support fixes, and the deployed decluttarr v2.1.0 image was built from the Add support for qBit 5.2.x commit. The remaining deployment blocker I found is the repo-owned cleanup.js path.

Sources

• Infra PR #2181 files
• qBittorrent v5.2.0 release
• qBittorrent v5.2.1 release
• qBittorrent WebAPI 204 behavior PR
• qBittorrent auth/login response PR
• qBittorrent session cookie rename PR
• qBittorrent session cookie documentation issue
• qBittorrent SSRF fix PR
• linuxserver/qbittorrent 5.2.1 release
• cross-seed v6.13.7 release
• qbit_manage v4.7.1 release
• decluttarr qBit 5.2 support commit

---

🟠 Verdict: Breaking

Do not merge as-is: qBittorrent 5.2 changes the login response and cookie contract, and the local cross-seed cleanup script is hard-coded to the 5.1 200 Ok./SID= behavior. The update brings v5.2.1 security and stability fixes, but this PR should stay renovate:breaking until that script is patched.