[home-gitops-bot]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/coredns/charts/coredns (source)	HelmChart	digest	f5eb638 → af68f0b

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[home-gitops-konflate]

Tip

Routine: only container-image and chart-version changes; 1 resource across 1 app

_{konflate 0.6.6 · rendered 0fd38c8 · full diff →}

[home-gitops-bot]

Kustomization diff

spec.ref.digest  (source.toolkit.fluxcd.io/v1/OCIRepository/kube-system/coredns)
  ± value change
    - sha256:f5eb6389e7ec1ffc654b41e1c90f1a4e10ef2b6d3f12d463291b2302efe06011
    + sha256:af68f0b55ad50e196d14acdc98017a424dece2b4b3d764ba6709fc2ff86cb9dc

_{Diff created by flate — Workflow run}

[home-gitops-bot]

Verdict: Safe to merge

Digest-only update for ghcr.io/coredns/charts/coredns — the chart tag stays at 1.49.0 (unchanged from before this PR), only the OCI manifest digest moves (sha256:f5eb638... → sha256:af68f0b...). No chart version bump, no values/schema changes, and no other files touched.

Checked coredns/helm releases: coredns-1.49.0 (tag unchanged) was published 2026-10-19 and its only functional change vs 1.48.2 is "Create a ServiceAccount for CoreDNS by default" (coredns/helm#284) — not relevant here since kubernetes/apps/kube-system/coredns/app/helmrelease.yaml already sets serviceAccount.create: true explicitly. The app-level CoreDNS image (mirror.gcr.io/coredns/coredns) is unaffected — this PR only touches the chart artifact, and the chart's image.tag isn't overridden here so it still tracks whatever the chart's default appVersion is, which is untouched by a digest-only refresh. Most likely explanation for the digest moving at a fixed tag: the publish workflow re-pushed/attested the same tag (e.g. provenance/SBOM attachment), not a content regression — consistent with Renovate's own type/digest classification.

No breaking changes, deprecations, or reconciliation risks identified.

Sources consulted:

• https://redirect.github.com/coredns/helm/releases/tag/coredns-1.49.0
• https://redirect.github.com/coredns/helm/compare/coredns-1.48.2...coredns-1.49.0

[home-gitops-bot]

Verdict: Safe to merge

Digest-only update for ghcr.io/coredns/charts/coredns — the chart tag stays at 1.49.0 (unchanged from before this PR), only the OCI manifest digest moves (sha256:f5eb638... -> sha256:af68f0b...). No chart version bump, no values/schema changes, and no other files touched.

Checked coredns/helm releases: coredns-1.49.0 (tag unchanged) was published 2026-10-19 and its only functional change vs 1.48.2 is "Create a ServiceAccount for CoreDNS by default" (coredns/helm#284) — not relevant here since kubernetes/apps/kube-system/coredns/app/helmrelease.yaml already sets serviceAccount.create: true explicitly. The app-level CoreDNS image (mirror.gcr.io/coredns/coredns) is unaffected — this PR only touches the chart artifact, and the chart's image.tag isn't overridden here so it still tracks whatever the chart's default appVersion is, which is untouched by a digest-only refresh. Most likely explanation for the digest moving at a fixed tag: the publish workflow re-pushed/attested the same tag (e.g. provenance/SBOM attachment), not a content regression — consistent with Renovate's own type/digest classification.

No breaking changes, deprecations, or reconciliation risks identified.

Sources consulted: redirect.github.com/coredns/helm/releases/tag/coredns-1.49.0, redirect.github.com/coredns/helm/compare/coredns-1.48.2...coredns-1.49.0