feat(container): update image ghcr.io/home-operations/tautulli ( 2.17.2 → 2.18.1 )

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/tautulli (source)	minor	2.17.2 → 2.18.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Tautulli/Tautulli (ghcr.io/home-operations/tautulli)

v2.18.1

Compare Source

• Activity:
  • Fix: Empty sessions row being added into the database.
• History:
  • Fix: Unable to expand detailed history when "Current Activity in History Tables" setting is enabled. (#​2805)
• Notifications:
  • Fix: Email password being overwritten with a blank value when saving email notification settings. (#​2804)
  • Fix: New device notification retriggering for Local user. (#​2795)
  • Fix: Sentinel values appearing in notification text enclosed in backticks. (#​2794)
• Other:
  • New: Added X-Frame-Options header to config file. (#​2807)
• API:
  • Fix: Guest users being able to retrieve history of another user through the API.
  • Change: Revert double nested data in get_plex_logs API command response. (#​2806)

v2.18.0

Compare Source

• Activity:
  • Fix: Displaying 4K resolution on activity cards.
  • New: Added Dolby Atmos to activity cards.
• Notifications:
  • New: Added Dolby Atmos notification parameters.
  • New: Support for Tautulli Remote App notifications sent using a push relay instead of OneSignal. OneSignal notifications will be deprecated on Oct. 1, 2026. (#​2772)
• Exporter:
  • New: Added editionTitle to export fields for shows, seasons, and episodes.
• History:
  • Fix: Double history table refresh on page load.
  • Fix: Paginate datatables queries in SQL instead of Python. (#​2728) (Thanks @​stephenp)
  • Fix: Various database optimizations to improve performance of history queries.
• UI:
  • Fix: Unable to edit users or libraries from the tables.
  • Fix: Dashboard stats card overflow/clipping on Firefox 153.0.3. (#​2776, #​2787) (Thanks @​maldis018)
  • New: Added button to delete/restore users and libraries from the user/library profile pages.
  • New: Added toggle for anonymous system analytics to the setup wizard and settings page. (#​2781)
• Other:
  • Fix: Improve Plex log file parsing.
  • Fix: Path traversal in update tarfile extraction. (CVE-2026-TBD) (Thanks @​tonghuaroot)
  • Fix: Plex token leakage in case-sensitive URL bypass in pms_image_proxy. (CVE-2026-TBD) (Thanks @​Xiaoyiyi23)
  • New: Build separate MacOS arm64 and x86_64 packages for Apple silicon and Intel Macs.
  • New: Added security headers to cherrypy response headers.
• API:
  • Fix: get_home_stats API command before and after parameters not working.
  • Fix: get_export_fields API command sub_media_type parameter not working.
  • Fix: search API command limit parameter not being applied.
  • Fix: delete_hosted_images API command return correct error response.
  • Fix: notify API command notify_action parameter clobbering if provided.
  • Fix: set_newsletter_config API command optional parameters subject/body/message.
  • Fix: download_plex_log and get_plex_log API commands return correct error response.
  • Fix: logout_user_session API command return correct error response when no row_id provided.
  • Fix: get_logs API command search/regex/sort before slicing.
  • Fix: get_recently_added API command response contained a blank section_id.
  • Fix: get_metadata API command return error for invalid rating_key provided.
  • Fix: sql API command making database backups on every query.
  • Fix: API commands not returning correct 400 error response.
  • New: Added Dolby Atmos info to the get_activity and get_metadata API command.
  • New: Allow X-Api-Key header to be used instead of the API key parameter.
  • New: Add API response to CORS preflight OPTIONS.
  • Change: edit_user and edit_library API commands to only update provided parameters.
  • Change: set_notifier_config and set_newsletter_config API commands to only update provided parameters.
  • Change: Double nested data in get_plex_logs API command response.
  • Removed: Deprecated delete_synced_item API command.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

--- HelmRelease media/tautulli
+++ HelmRelease media/tautulli
@@ -31,7 +31,7 @@
               TZ: ..PLACEHOLDER_SECRET_TIMEZONE..
             image:
               repository: ghcr.io/home-operations/tautulli
-              tag: 2.17.2@sha256:7592e192e2dd5297054a80c0f1e8b2593f7675af75c5020806b30c712e159406
+              tag: 2.18.1@sha256:2cc92abed174f89d4fa75ab98e39af0114f37829e9c675718b264cc80931c4f5
             probes:
               liveness:
                 custom: true

[github-actions]

--- Deployment media/tautulli
+++ Deployment media/tautulli
@@ -34,7 +34,7 @@
       - env:
         - name: TZ
           value: ..PLACEHOLDER_SECRET_TIMEZONE..
-        image: ghcr.io/home-operations/tautulli:2.17.2@sha256:7592e192e2dd5297054a80c0f1e8b2593f7675af75c5020806b30c712e159406
+        image: ghcr.io/home-operations/tautulli:2.18.1@sha256:2cc92abed174f89d4fa75ab98e39af0114f37829e9c675718b264cc80931c4f5
         livenessProbe:
           failureThreshold: 3
           httpGet:

[chrtol-konflate]

konflate — summary

Note

+0 added · 2 changed · −0 removed — 2 resources · 2 apps

Tip

Routine — only container-image and chart-version changes; nothing else changed.

Blast radius

• Kustomization media/tautulli — 1 dependent (Kustomization media/tautulli-authentik-sync)

Image changes

image	from	to
ghcr.io/home-operations/tautulli	sha256:7592e192e2dd…	sha256:2cc92abed174…

View the full rendered diff →

_{konflate · rendered aa20d20 · advisory, not a gate}