feat(container): update ghcr.io/calibrain/shelfmark ( v1.2.3 ➔ v1.3.0 ) (#23)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/calibrain/shelfmark](https://github.com/calibrain/shelfmark) | minor | `v1.2.3` → `v1.3.0` |

---

### Release Notes

<details>
<summary>calibrain/shelfmark (ghcr.io/calibrain/shelfmark)</summary>

### [`v1.3.0`](https://github.com/calibrain/shelfmark/releases/tag/v1.3.0)

[Compare Source](calibrain/shelfmark@v1.3.0...v1.3.0)

This release adds a new security option, fixes Prowlarr seedtime preferences, and implements several fixes and security hardening changes.

##### New:

- Added `DISABLE_LOCAL_AUTH` environment variable for OIDC-only configs
- Changed Prowlarr seedtime preference to opt-in (Enable in Settings > Prowlarr). Fixed an issue with user-specified seed time configs not pulling into shelfmark correctly.

##### Fixes

- Fixed Google Books error responses being cached as search results. ([#&#8203;958](calibrain/shelfmark#958))
- Fixed language filter matching by normalising language strings more consistently. ([#&#8203;960](calibrain/shelfmark#960))
- Improved download copy/hardlink handling on FUSE & NFS. ([#&#8203;957](calibrain/shelfmark#957), [#&#8203;961](calibrain/shelfmark#961))
- Streamed archive extraction instead of loading archive contents into memory. ([#&#8203;965](calibrain/shelfmark#965))
- Fixed Tor routing and healthchecks so Tor can bootstrap correctly, private networks can bypass Tor, and healthchecks no longer require a clear-net probe. ([#&#8203;944](calibrain/shelfmark#944), [#&#8203;966](calibrain/shelfmark#966))

##### Security

- Updated frontend, Python, and CodeQL dependencies, including fixing an 11th May `urllib3` CVE ([#&#8203;952](calibrain/shelfmark#952), [#&#8203;953](calibrain/shelfmark#953), [#&#8203;954](calibrain/shelfmark#954))
- Hardened cover-image fetching and download prefetch flows against unsafe remote URLs, redirects, and untrusted origins. ([#&#8203;943](calibrain/shelfmark#943), [#&#8203;967](calibrain/shelfmark#967), [#&#8203;976](calibrain/shelfmark#976))
- Tightened download and queue authorization, including queue ownership checks, release-source availability checks, and request policy source validation. ([#&#8203;970](calibrain/shelfmark#970), [#&#8203;971](calibrain/shelfmark#971), [#&#8203;975](calibrain/shelfmark#975))
- Contained remote path mappings and qBittorrent fallback path handling to prevent unsafe path resolution. ([#&#8203;973](calibrain/shelfmark#973), [#&#8203;974](calibrain/shelfmark#974))
- Validated IRC DCC offers and AudiobookBay detail URLs before using them. ([#&#8203;964](calibrain/shelfmark#964), [#&#8203;972](calibrain/shelfmark#972))
- Redacted release URLs more safely in Newznab/Prowlarr download flows. ([#&#8203;968](calibrain/shelfmark#968))
- Required verified OIDC email claims before linking external identities to existing accounts. ([#&#8203;963](calibrain/shelfmark#963))
- Made container startup fail closed when the config directory remains unwritable instead of falling back to root. ([#&#8203;985](calibrain/shelfmark#985))
- Pinned Docker base image digests and removed installer tooling from runtime images. ([#&#8203;969](calibrain/shelfmark#969), [#&#8203;978](calibrain/shelfmark#978))

### [`v1.3.0`](https://github.com/calibrain/shelfmark/releases/tag/v1.3.0)

[Compare Source](calibrain/shelfmark@v1.2.3...v1.3.0)

This release adds a new security option, fixes Prowlarr seedtime preferences, and implements several fixes and security hardening changes.

##### New:

- Added `DISABLE_LOCAL_AUTH` environment variable for OIDC-only configs
- Changed Prowlarr seedtime preference to opt-in (Enable in Settings > Prowlarr). Fixed an issue with user-specified seed time configs not pulling into shelfmark correctly.

##### Fixes

- Fixed Google Books error responses being cached as search results. ([#&#8203;958](calibrain/shelfmark#958))
- Fixed language filter matching by normalising language strings more consistently. ([#&#8203;960](calibrain/shelfmark#960))
- Improved download copy/hardlink handling on FUSE & NFS. ([#&#8203;957](calibrain/shelfmark#957), [#&#8203;961](calibrain/shelfmark#961))
- Streamed archive extraction instead of loading archive contents into memory. ([#&#8203;965](calibrain/shelfmark#965))
- Fixed Tor routing and healthchecks so Tor can bootstrap correctly, private networks can bypass Tor, and healthchecks no longer require a clear-net probe. ([#&#8203;944](calibrain/shelfmark#944), [#&#8203;966](calibrain/shelfmark#966))

##### Security

- Updated frontend, Python, and CodeQL dependencies, including fixing an 11th May `urllib3` CVE ([#&#8203;952](calibrain/shelfmark#952), [#&#8203;953](calibrain/shelfmark#953), [#&#8203;954](calibrain/shelfmark#954))
- Hardened cover-image fetching and download prefetch flows against unsafe remote URLs, redirects, and untrusted origins. ([#&#8203;943](calibrain/shelfmark#943), [#&#8203;967](calibrain/shelfmark#967), [#&#8203;976](calibrain/shelfmark#976))
- Tightened download and queue authorization, including queue ownership checks, release-source availability checks, and request policy source validation. ([#&#8203;970](calibrain/shelfmark#970), [#&#8203;971](calibrain/shelfmark#971), [#&#8203;975](calibrain/shelfmark#975))
- Contained remote path mappings and qBittorrent fallback path handling to prevent unsafe path resolution. ([#&#8203;973](calibrain/shelfmark#973), [#&#8203;974](calibrain/shelfmark#974))
- Validated IRC DCC offers and AudiobookBay detail URLs before using them. ([#&#8203;964](calibrain/shelfmark#964), [#&#8203;972](calibrain/shelfmark#972))
- Redacted release URLs more safely in Newznab/Prowlarr download flows. ([#&#8203;968](calibrain/shelfmark#968))
- Required verified OIDC email claims before linking external identities to existing accounts. ([#&#8203;963](calibrain/shelfmark#963))
- Made container startup fail closed when the config directory remains unwritable instead of falling back to root. ([#&#8203;985](calibrain/shelfmark#985))
- Pinned Docker base image digests and removed installer tooling from runtime images. ([#&#8203;969](calibrain/shelfmark#969), [#&#8203;978](calibrain/shelfmark#978))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNyIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19-->

Co-authored-by: todd <tpunderson@greyrock.io>
Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/23

Author: 2 people

kubernetes/apps/downloads/shelfmark/app/helmrelease.yaml

@@ -23,7 +23,7 @@ spec:
           shelfmark:
             image:
               repository: ghcr.io/calibrain/shelfmark
-              tag: v1.2.3@sha256:bd6cb4bfa14a917e76945c22ed2c376d64cf7fdb74632435db713d42ca597b20
+              tag: v1.3.0@sha256:e891eda444b261da48a839db652034bce4e20ac09c167f14adf939dedf96b572
             command:
               - gunicorn
             args: