Update dependency k3s-io/k3s to v1.24.17+k3s1 (main)

[renovate-rancher]

This PR contains the following updates:

Package	Update	Change
k3s-io/k3s	patch	v1.24.8+k3s1 -> v1.24.17+k3s1

---

Release Notes

k3s-io/k3s (k3s-io/k3s)

v1.24.17+k3s1: v1.24.17+k3s1

Compare Source

This release updates Kubernetes to v1.24.17, and fixes a number of issues.

⚠️ IMPORTANT: This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See GHSA-m4hf-6vgr-75r2 for more information, including mandatory steps necessary to harden clusters against this vulnerability.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.16+k3s1:

• Update cni plugins version to v1.3.0 (#​8087)
• Etcd snapshots retention when node name changes (#​8124)
• August Test Backports (#​8128)
• Backports for 2023-08 release (#​8135)
  • K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries.
  • K3s no longer enables the apiserver's enable-aggregator-routing flag when the egress proxy is not being used to route connections to in-cluster endpoints.
  • Updated the embedded containerd to v1.7.3+k3s1
  • Updated the embedded runc to v1.1.8
  • User-provided containerd config templates may now use {{ template "base" . }} to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file.
  • Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client.
  • Updated kine to v0.10.2
• K3s etcd-snapshot delete fail to delete local file when called with s3 flag (#​8146)
• Fix for cluster-reset backup from s3 when etcd snapshots are disabled (#​8168)
• Fixed the etcd retention to delete orphaned snapshots based on the date (#​8191)
• Additional backports for 2023-08 release (#​8214)
  • The version of helm used by the bundled helm controller's job image has been updated to v3.12.3
  • Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes.
  • The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake.
• Fix runc version bump (#​8243)
• Update to v1.24.17 (#​8240)
• Add new CLI flag to enable TLS SAN CN filtering (#​8260)
  • Added a new --tls-san-security option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client.
• Add RWMutex to address controller (#​8276)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.17
Kine	v0.10.2
SQLite	3.42.0
Etcd	v3.5.3-k3s1
Containerd	v1.7.3-k3s1
Runc	v1.1.8
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.4
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.16+k3s1: v1.24.16+k3s1

Compare Source

This release updates Kubernetes to v1.24.16, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.14+k3s1:

• Fix code spell check (#​7861)
• Remove file_windows.go (#​7857)
• Allow k3s to customize apiServerPort on helm-controller (#​7872)
• Fix rootless node password (#​7899)
• Backports for 2023-07 release (#​7910)
  • Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted.
  • The k3s certificate rotate-ca command now supports the data-dir flag.
• Adding cli to custom klipper helm image (#​7916)
  • The default helm-controller job image can now be overridden with the --helm-job-image CLI flag
• Generation of certs and keys for etcd gated if etcd is disabled (#​7946)
• Don't use zgrep in check-config if apparmor profile is enforced (#​7955)
• Fix image_scan.sh script and download trivy version (#​7950) (#​7970)
• Adjust default kubeconfig file permissions (#​7985)
• Update to v1.24.16 (#​8023)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.16
Kine	v0.10.1
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.7.1-k3s1
Runc	v1.1.7
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.2
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.15+k3s1: v1.24.15+k3s1

Compare Source

This release updates Kubernetes to v1.24.15, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.14+k3s1:

• E2E Backports - June (#​7726)
  • Shortcircuit commands with version or help flags #​7683
  • Add Rotation certification Check, remove func to restart agents #​7097
  • E2E: Sudo for RunCmdOnNode #​7686
• Fix spelling check (#​7753)
• Backport version bumps and bugfixes (#​7719)
  • The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default.
  • The coredns-custom ConfigMap now allows for *.override sections to be included in the .:53 default server block.
  • The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user.
  • Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local.
  • Make LB image configurable when compiling k3s
  • K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod.
  • The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release.
  • The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist.
• Remove unused libvirt config (#​7759)
• Add format command on Makefile (#​7764)
• Update Kubernetes to v1.24.15 (#​7785)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.15
Kine	v0.10.1
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.7.1-k3s1
Runc	v1.1.7
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.3
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.15.0
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.14+k3s1: v1.24.14+k3s1

Compare Source

This release updates Kubernetes to v1.24.14, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.13+k3s1:

• Add E2E testing in Drone (#​7376)
• Add integration tests for etc-snapshot server flags (#​7379)
• CLI + Config Enhancement (#​7407)
  • --Tls-sans now accepts multiple arguments: --tls-sans="foo,bar"
  • Prefer-bundled-bin: true now works properly when set in config.yaml.d files
• Migrate netutil methods into /utils/net.go (#​7435)
• Bump Runc + Containerd + Docker for CVE fixes (#​7453)
• Bump kube-router version to fix a bug when a port name is used (#​7462)
• Kube flags and longhorn tests 1.24 (#​7467)
• Local-storage: Fix permission (#​7472)
• Backport version bumps and bugfixes (#​7516)
  • K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.
  • K3s once again supports aarch64 nodes with page size > 4k
  • The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0
  • K3s now prints a more meaningful error when attempting to run from a filesystem mounted noexec.
  • K3s now exits with a proper error message when the server token uses a bootstrap token id.secret format.
  • Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content.
  • Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component.
  • Fixed an regression that prevented the pod and cluster egress-selector modes from working properly.
  • K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes.
  • K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster.
  • The embedded kine version has been bumped to v0.10.1. This replaces the legacy lib/pq postgres driver with pgx.
  • The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle.
  • The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap.
• Bump containerd/runc to v1.7.1-k3s1/v1.1.7 (#​7536)
  • The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7
• Wrap error stating that it is coming from netpol (#​7549)
• Update to v1.24.14-k3s1 (#​7577)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.14
Kine	v0.10.1
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.7.1-k3s1
Runc	v1.1.7
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.10
CoreDNS	v1.10.1
Helm-controller	v0.14.0
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.13+k3s1: v1.24.13+k3s1

Compare Source

This release updates Kubernetes to v1.24.13, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.12+k3s1:

• Enhance check-config (#​7165)
• Remove deprecated nodeSelector label beta.kubernetes.io/os (#​6970) (#​7122)
• Backport version bumps and bugfixes (#​7229)
  • The bundled local-path-provisioner version has been bumped to v0.0.24
  • The bundled runc version has been bumped to v1.1.5
  • The bundled coredns version has been bumped to v1.10.1
  • When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously.
  • The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member.
  • Fixed a race condition during cluster reset that could cause the operation to hang and time out.
• Updated kube-router to move the default ACCEPT rule at the end of the chain (#​7222)
  • The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users.
• Update klipper lb and helm-controller (#​7241)
• Update Kube-router ACCEPT rule insertion and install script to clean rules before start (#​7277)
  • The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users.
• Update to v1.24.13-k3s1 (#​7284)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.13
Kine	v0.9.9
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.19-k3s1
Runc	v1.1.5
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.10.1
Helm-controller	v0.13.3
Local-path-provisioner	v0.0.24

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.12+k3s1: v1.24.12+k3s1

Compare Source

This release updates Kubernetes to v1.24.12, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.11+k3s1:

• Update flannel and kube-router (#​7063)
• Bump various dependencies for CVEs (#​7042)
• Enable dependabot (#​7046)
• Wait for kubelet port to be ready before setting (#​7065)
  • The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object.
• Improve support for rotating the default self-signed certs (#​7080)
  • The k3s certificate rotate-ca checks now support rotating self-signed certificates without the --force option.
• Adds a warning about editing to the containerd config.toml file (#​7076)
• Update to v1.24.12-k3s1 (#​7105)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.12
Kine	v0.9.9
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.19-k3s1
Runc	v1.1.4
Flannel	v0.21.3-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.9.4
Helm-controller	v0.13.1
Local-path-provisioner	v0.0.23

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.11+k3s1: v1.24.11+k3s1

Compare Source

This release updates Kubernetes to v1.24.11, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.10+k3s1:

• Add jitter to scheduled snapshots and retry harder on conflicts (#​6783)
  • Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list.
• Bump cri-dockerd (#​6799)
  • The embedded cri-dockerd has been updated to v0.3.1
• Bugfix: do not break cert-manager when pprof is enabled (#​6838)
• Bump vagrant boxes to fedora37 (#​6859)
• Fix cronjob example (#​6865)
• Ensure flag type consistency (#​6868)
• Wait for cri-dockerd socket (#​6854)
• Consolidate E2E tests (#​6888)
• Ignore value conflicts when reencrypting secrets (#​6918)
• Allow ServiceLB to honor ExternalTrafficPolicy=Local (#​6908)
  • ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members.
• Use default address family when adding kubernetes service address to SAN list (#​6905)
  • The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family.
• Fix issue with servicelb startup failure when validating webhooks block creation (#​6920)
  • The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use.
• Backport user-provided CA cert and kubeadm bootstrap token support (#​6930)
  • K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at contrib/util/certs.sh.
  • K3s now supports kubeadm style join tokens. k3s token create now creates join token secrets, optionally with a limited TTL.
  • K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster.
• Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent (#​6937)
  • Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode.
• Update flannel to v0.21.1 (#​6925)
• Allow for multiple sets of leader-elected controllers (#​6942)
  • Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes
• Fix etcd and ca-cert rotate issues (#​6955)
• Fix ServiceLB dual-stack ingress IP listing (#​6988)
  • Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation.
• Bump kine to v0.9.9 (#​6976)
  • The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at info level for increased visibility.
• Update to v1.24.11-k3s1 (#​7009)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.11
Kine	v0.9.9
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.15-k3s1
Runc	v1.1.4
Flannel	v0.21.1-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.9.4
Helm-controller	v0.13.1
Local-path-provisioner	v0.0.23

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.10+k3s1: v1.24.10+k3s1

Compare Source

This release updates Kubernetes to v1.24.10+k3s1, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.9+k3s2:

• Pass through default tls-cipher-suites (#​6731)
  • The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values.
• Bump containerd to v1.6.15-k3s1 (#​6736)
  • The embedded containerd version has been bumped to v1.6.15-k3s1
• Bump action/download-artifact to v3 (#​6748)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.10
Kine	v0.9.6
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.15-k3s1
Runc	v1.1.4
Flannel	v0.20.2-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.9.4
Helm-controller	v0.13.1
Local-path-provisioner	v0.0.23

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.9+k3s1: v1.24.9+k3s1

Compare Source

⚠️ WARNING

This release is affected by https://github.com/containerd/containerd/issues/7843, which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use v1.24.9+k3s2 instead.

This release updates Kubernetes to v1.24.9, and fixes a number of issues.

Breaking Change: K3s no longer includes swanctl and charon binaries. If you are using the ipsec flannel backend, please ensure that the strongswan swanctl and charon packages are installed on your node before upgrading K3s to this release.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.24.8+k3s1:

• Remove stuff which belongs in the windows executor implementation (#​6502)
• Github CI Updates (#​6535)
• Fix log for flannelExternalIP use case (#​6540)
• Switch from Google Buckets to AWS S3 Buckets (#​6570)
• Change secrets-encryption flag to GA (#​6591)
• Update flannel to v0.20.2 (#​6589)
• Backports for 2022-12 (#​6599)
  • Added new prefer-bundled-bin flag which force K3s to use its bundle binaries over that of the host tools
  • The embedded containerd version has been updated to v1.6.10-k3s1
  • The rootless port-driver, cidr, mtu, enable-ipv6, and disable-host-loopback settings can now be configured via environment variables.
  • The embedded Load-Balancer controller image has been bumped to klipper-lb:v0.4.0, which includes support for the LoadBalancerSourceRanges field.
  • The embedded Helm controller image has been bumped to klipper-helm:v0.7.4-build20221121
  • The embedded cloud-controller-manager's metrics listener on port 10258 is now disabled when the --disable-cloud-controller flag is set.
  • Deployments for K3s packaged components now have consistent upgrade strategy and revisionHistoryLimit settings, and will not override scaling decisions by hardcoding the replica count.
  • The packaged metrics-server has been bumped to v0.6.2
  • The embedded k3s-root version has been bumped to v0.12.0, based on buildroot 2022.08.1.
  • The embedded swanctl and charon binaries have been removed. If you are using the ipsec flannel backend, please ensure that the strongswan swanctl and charon packages are installed on your node before upgrading k3s.
• Update node12->node16 based GH actions (#​6595)
• Update to v1.24.9-k3s1 (#​6623)
• Bump containerd to v1.6.12-k3s1 (#​6630)
  • The embedded containerd version has been bumped to v1.6.12
• Preload iptable_filter/ip6table_filter (#​6647)

Embedded Component Versions

Component	Version
Kubernetes	v1.24.9
Kine	v0.9.6
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.12-k3s1
Runc	v1.1.4
Flannel	v0.20.2-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.9.4
Helm-controller	v0.13.1
Local-path-provisioner	v0.0.23

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.24.9+k3s2: v1.24.9+k3s2

Compare Source

This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted.

Changes since v1.24.9+k3s1:

• Backport missing E2E test commits (#​6616)
• Bump containerd to v1.6.14-k3s1 (#​6695)
  • The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for containerd/7843 which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod.

Embedded Component Versions

Component	Version
Kubernetes	v1.24.9
Kine	v0.9.6
SQLite	3.39.2
Etcd	v3.5.3-k3s1
Containerd	v1.6.14-k3s1
Runc	v1.1.4
Flannel	v0.20.2-k3s1.23
Metrics-server	v0.6.2
Traefik	v2.9.4
CoreDNS	v1.9.4
Helm-controller	v0.13.1
Local-path-provisioner	v0.0.23

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.