chore: update base image to HAProxy 3.4 LTS and track LTS in Renovate - #117
Conversation
Move the production and debugging images from HAProxy 3.2.22 to 3.4.4 on Alpine 3.24. 3.4 is the current LTS branch, supported until 2031-Q2, where 3.2 reaches EOL in 2030-Q2. Deliberately skip 3.3: it is a non-LTS branch that stops receiving fixes around 2027-Q1, so it would be a downgrade in support horizon. The pinned haproxy-python-spoa commit is unchanged and remains upstream HEAD. Verified against 3.4.4 by building both images and driving traffic through the exapps frontend: the SPOE agent returns verdicts for request paths up to 6 KB and headers up to 7 KB (multi-segment frames, which the pinned single-write commit exists to handle) with no SPOP frame, mux, or reset errors, and the container reports healthy. Configure Renovate to keep the base image on LTS branches only. HAProxy ships LTS on even minors, so match that shape rather than a fixed version ceiling, which would have let a future non-LTS branch through. Minor and major bumps are split into their own PR labelled needs-spoe-testing, since those are the ones that can change SPOP mux behaviour. Also replace the deprecated config:base preset with config:recommended and group GitHub Actions bumps into a single PR. Signed-off-by: Simon L. <szaimen@e.mail.de>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe change upgrades the primary and debugging HAProxy images from 3.2.22 to 3.4.4 on Alpine 3.24. It updates the SPOA compatibility comment for HAProxy 3.4 LTS. Renovate now uses the recommended preset and defines rules for even-minor HAProxy LTS versions, HAProxy branch upgrades, and grouped GitHub Actions updates. Merge Risk: ⚪ Minimal · up to This PR updates the HAProxy base images to the 3.4 LTS branch and adjusts Renovate tracking without a supplied concrete correctness, security, availability, or deployment risk; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3 participants
Summary
Moves the production and debugging images from HAProxy 3.2.22 → 3.4.4 on Alpine 3.24, and configures Renovate to keep the base image on LTS branches going forward.
3.4 is the current LTS branch, supported until 2031-Q2; 3.2 reaches EOL in 2030-Q2.
Why not 3.3
3.3.14 is published and newer than our previous pin, but 3.3 is a non-LTS branch that stops receiving fixes around 2027-Q1. Moving to it would have shortened our support horizon rather than extending it.
SPOE verification
The pinned
haproxy-python-spoacommit (f00f3f7) is unchanged — it is still upstream HEAD, so there was nothing to co-bump. That pin exists because HAProxy 3.2+ resets SPOP connections when a frame arrives split across TCP segments, so a two-minor jump is exactly the change that could break it.Verified locally against 3.4.4:
long-term supported branch - will stop receiving fixes around Q2 2031.Runtime deps resolve as expected:
haproxyspoa, pydantic 2.13.4, aiohttp 3.13.5, and FRP 0.65.0 from Alpine.Renovate
config:base→config:recommended(the old preset is deprecated).<3.5cap would have let a future non-LTS branch through on the next cycle. Regex tested against real published tags: allows 3.4/3.2/3.0/2.8 and3.10.x, rejects 3.3/3.1.needs-spoe-testing, since those are the ones that can change SPOP mux behaviour. Patch bumps stay routine.Notes for review
renovate-config-validatorwas not run — it needs Node 18+ and the local environment has v16. The JSON parses and the fields match the documented schema, but CI or a reviewer with a newer Node should confirm.ARG FRP_VERSION=0.61.1inREADME.mdis stale, since the image now ships FRP 0.65.0.