fix(deps): update pihole/pihole docker tag to v2026.07.2

[renovate]

This PR contains the following updates:

Package	Update	Change
pihole/pihole	minor	2026.02.0 → 2026.07.2

---

Release Notes

pi-hole/docker-pi-hole (pihole/pihole)

v2026.07.2

Compare Source

Missing commit from previous release which is the docker-equivalent of the fix for pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww

• Move logrotate file to /etc/logrotate.d/pihole 14b661a by @​yubiuser

Full Changelog: pi-hole/docker-pi-hole@2026.07.1...2026.07.2

v2026.07.1

Compare Source

What's Changed

• Restore --no-cache flag for apk by @​casperklein in #​2056

Full Changelog: pi-hole/docker-pi-hole@2026.07.0...2026.07.1

v2026.07.0

Compare Source

What's Changed (Docker Specific)

• Add ShellCheck CI and fix reported issues by @​lightswitch05 in #​2039
• Make crond and cron job output visible in "docker log" by @​casperklein in #​2035
• feat: optimize Docker build caching by @​lightswitch05 in #​2038
• remove buildkit cache mount from apk add layer by @​PromoFaux in #​2049

Full Changelog: pi-hole/docker-pi-hole@2026.04.1...2026.07.0

Security Fixes

• pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww — Local privilege escalation from pihole user to root via /etc/pihole/logrotate (High) reported by supperhellokitty20
• pi-hole/FTL/security/advisories/GHSA-q6fm-xwxf-37r5 — WebUI (& API) DoS via lack of rate limiting (High) reported by rrobgill
• pi-hole/FTL/security/advisories/GHSA-w8cr-2cwg-92cg — Session expiration bypass (High) reported by T0X1Cx
• pi-hole/FTL/security/advisories/GHSA-8j7w-m3cr-6q6x — Remote Code Execution via CivetWeb configuration injection (High) reported by SakusenSec
• pi-hole/FTL/security/advisories/GHSA-g7v8-8q8f-hprp — Log injection in the access-log writer chaining to RCE via Lua-server-page evaluation (Moderate)
• pi-hole/FTL/security/advisories/GHSA-r5vh-5q82-jg7q — CRLF injection / HTTP header injection via group name (Low) reported by T0X1Cx

What's Changed (FTL v6.7)

• Performance optimizations and bug fixes by @​DL6ER in pi-hole/FTL#2816
• fix: check NULL returns from strdup/calloc in rotate_files() by @​jluzzi123 in pi-hole/FTL#2875
• Make error messages more human friendly by @​yubiuser in pi-hole/FTL#2878
• Harden API/database races in civetweb and DB threads by @​DL6ER in pi-hole/FTL#2881
• Update embedded SQLite3 to v3.53.1 by @​DL6ER in pi-hole/FTL#2891
• Fix build on Fedora 44 by @​darkexplosiveqwx in pi-hole/FTL#2893
• macvendor: resolve sub-allocated blocks (MA-M/MA-S) via longest-prefix match by @​RamSet in pi-hole/FTL#2907
• Update embedded dnsmasq to v2.93 by @​DL6ER in pi-hole/FTL#2890
• fix OOB write in FTL_parse_pseudoheaders when optlen is 0 by @​rdevshp in pi-hole/FTL#2910
• Update a single text description "PRIVATE KEY" by @​DoctorD90 in pi-hole/FTL#2884
• add optional dnsmasq features to cmake by @​darkexplosiveqwx in pi-hole/FTL#2874
• Fix building on alpine 3.24 by @​yubiuser in pi-hole/FTL#2911
• Bats by @​yubiuser in pi-hole/FTL#2872
• Improve crash backtraces for non-reproducible faults by @​DL6ER in pi-hole/FTL#2880
• Fix gzip.c inflate_buffer CRC signed left shift undefined behavior by @​rdevshp in pi-hole/FTL#2916
• Fix for iCloud Private Relay zones by @​DL6ER in pi-hole/FTL#2919
• fix tar parsing by @​rdevshp in pi-hole/FTL#2914
• Allow using local manufs to generate macvendor.db by @​darkexplosiveqwx in pi-hole/FTL#2918
• Use custom message for UNIQUE constraint error message by @​rdwebdesign in pi-hole/FTL#2879
• Re-resolve client groups event-driven, drop periodic recheck by @​DL6ER in pi-hole/FTL#2922
• Guard against invalid gzip data in gzip.c inflate_buffer by @​rdevshp in pi-hole/FTL#2915
• Fix BATS test of no ERRORS in FTL.log to allow capturing the output by @​yubiuser in pi-hole/FTL#2927
• fix(cli): warn when --config cannot read pihole.toml (#​2849) by @​DL6ER in pi-hole/FTL#2930
• fix(api-docs): correct three OpenAPI spec issues (#​2867) by @​DL6ER in pi-hole/FTL#2929
• fix: avoid segfault in dnsmasq-test on unreadable config file by @​DL6ER in pi-hole/FTL#2928
• Fix prefix-match bug and improve fallthrough logging in redirect_root_handler by @​slmingol in pi-hole/FTL#2933
• Swap misaligned comments for domain-needed and expand-hosts. by @​0xpsyduck in pi-hole/FTL#2932
• Code review July 2026 by @​DL6ER in pi-hole/FTL#2935
• Pi-hole FTL v6.7 by @​PromoFaux in pi-hole/FTL#2936

New Contributors

• @​jluzzi123 made their first contribution in pi-hole/FTL#2875
• @​RamSet made their first contribution in pi-hole/FTL#2907
• @​rdevshp made their first contribution in pi-hole/FTL#2910
• @​DoctorD90 made their first contribution in pi-hole/FTL#2884
• @​slmingol made their first contribution in pi-hole/FTL#2933
• @​0xpsyduck made their first contribution in pi-hole/FTL#2932

Full Changelog: pi-hole/FTL@v6.6.2...v6.7

What's Changed (Core v6.4.3)

• Also hardcode the PID file location in utils.sh to prevent readonly variable warning by @​PromoFaux in pi-hole/pi-hole#6613
• Use awk to compare curl versions by @​rdwebdesign in pi-hole/pi-hole#6621
• Explicitly add gawk to APK dependencies by @​yubiuser in pi-hole/pi-hole#6622
• Prevent double error message output in gravity run with invalid file by @​PromoFaux in pi-hole/pi-hole#6607
• Replace pytest/tox with direct in-container BATS by @​PromoFaux in pi-hole/pi-hole#6598
• Add Fedora 44 and Ubuntu 26.04 LTS to tests by @​darkexplosiveqwx in pi-hole/pi-hole#6623
• Add gravity tests by @​yubiuser in pi-hole/pi-hole#6639
• Set BATS pretty output flag depending on the terminal and improve failure output by @​yubiuser in pi-hole/pi-hole#6644
• fix: check return codes in gravity_build_tree and database_recovery() by @​jluzzi123 in pi-hole/pi-hole#6630
• Include alpine 3.24 in tests by @​yubiuser in pi-hole/pi-hole#6654
• installer: fix custom DNS entry when only one upstream server is provided by @​Gilmoursa in pi-hole/pi-hole#6638
• Fix BATS gravity test on curl version >=8.21 by @​yubiuser in pi-hole/pi-hole#6661
• avoid copytruncate in logrotate by @​darkexplosiveqwx in pi-hole/pi-hole#6642

New Contributors

• @​jluzzi123 made their first contribution in pi-hole/pi-hole#6630
• @​Gilmoursa made their first contribution in pi-hole/pi-hole#6638

Full Changelog: pi-hole/pi-hole@v6.4.2...v6.4.3

What's Changed (Web v6.6)

• Improve DHCP static leases interface (alternative) by @​rdwebdesign in pi-hole/web#3766
• Lists page - Improve hints and help text by @​rdwebdesign in pi-hole/web#3798
• Update daterangepicker ranges everytime the picker is shown by @​yubiuser in pi-hole/web#3793
• Better user interface to edit reverse DNS servers (dns.revServers) by @​rdwebdesign in pi-hole/web#3769

Full Changelog: pi-hole/web@v6.5.1...v6.6

v2026.06.0

Compare Source

What's Changed (Docker Specific)

• docs: update capability documentation links by @​SirRGB in #​2025

New Contributors

• @​SirRGB made their first contribution in #​2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.06.0

---

What's Changed (Web 6.5.1)

• Fix backed-up typo by @​yubiuser in pi-hole/web#3759
• fix: replace ES2024 regex v flag with u for WebKit compatibility by @​Gilmoursa in pi-hole/web#3778
• bug: multiline comments on doughnut chart by @​vinaykulk621 in pi-hole/web#3781

New Contributors

• @​Gilmoursa made their first contribution in pi-hole/web#3778
• @​vinaykulk621 made their first contribution in pi-hole/web#3781

Full Changelog: pi-hole/web@v6.5...v6.5.1

v2026.05.0

Compare Source

This tag includes the FTL v6.6.2 release which imports six upstream dnsmasq security fixes, covering all publicly disclosed CVEs against the dnsmasq 2.92/2.93 line. Patches are taken verbatim from https://thekelleys.org.uk/dnsmasq/CVE/

Details here: https://github.com/pi-hole/FTL/releases/tag/v6.6.2

Upgrade impact

All six fixes are minimal, self-contained changes to the embedded dnsmasq sources. No FTL-side configuration or API changes; users should see no observable behavior change beyond the closed vulnerabilities.

Fix dnsmasq CVE publications by @​DL6ER in pi-hole/FTL#2888

This furthermore indirectly fixes #​2871 due to pi-hole/docker-base-images#158

Full Changelog: pi-hole/FTL@v6.6.1...v6.6.2

---

What's Changed (Docker Specific)

• docs: update capability documentation links by @​SirRGB in #​2025

New Contributors

• @​SirRGB made their first contribution in #​2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.05.0

v2026.04.1

Compare Source

What's Changed

• docs: update capability documentation links by @​SirRGB in #​2025

New Contributors

• @​SirRGB made their first contribution in #​2025

Full Changelog: pi-hole/docker-pi-hole@2026.04.0...2026.04.1

New component versions included in this tag:

What's Changed (FTL v6.6.1)

• Add new GET /api/config/_properties endpoint by @​DL6ER in pi-hole/FTL#2356
• Fix thread-safety issues causing SIGSEGV under concurrent API load by @​DL6ER in pi-hole/FTL#2835
• fix: fix rare race condition for SHM strings in API handlers by @​DL6ER in pi-hole/FTL#2833
• Accept punycode domains that libidn2 rejects under IDNA2008 by @​DL6ER in pi-hole/FTL#2838
• Improve shutdown diagnostics to identify SIGTERM source by @​DL6ER in pi-hole/FTL#2839
• Resolve empty backtraces when addr2line is not installed by @​DL6ER in pi-hole/FTL#2831
• Improve thread-safety for concurrent API requests by @​DL6ER in pi-hole/FTL#2847
• Don't skip device lookup when resolver.macNames is disabled by @​DL6ER in pi-hole/FTL#2846
• Fix linker error when compiling w/o optimization by @​aeolio in pi-hole/FTL#2850
• Clarify dns.blockESNI wording by @​darkexplosiveqwx in pi-hole/FTL#2784
• Preserve log file path config when fopen fails by @​DL6ER in pi-hole/FTL#2834

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/FTL@88c569a and pi-hole/pi-hole@7ccb8dd
• GHSA-9cqv-839p-gpq2
  • Fixed with : pi-hole/FTL@0c46e4e

New Contributors

• @​darkexplosiveqwx made their first contribution in pi-hole/FTL#2784

Full Changelog: pi-hole/FTL@v6.6...v6.6.1

What's Changed (Core v6.4.2)

• Wipe version file before creating a new one by @​yubiuser in pi-hole/pi-hole#6538
• Fix ownership permissions for containing directories in fix_owner_per… by @​PromoFaux in pi-hole/pi-hole#6589
• Remove reference to /usr/local/bin/COL_TABLE by @​darkexplosiveqwx in pi-hole/pi-hole#6594
• Skip apt cache update when pihole-meta is current by @​PromoFaux in pi-hole/pi-hole#6581
• Set versions in /etc/pihole/versions to null if script fails by @​yubiuser in pi-hole/pi-hole#6550
• Remove redundant touching of logfiles from systemd Service by @​yubiuser in pi-hole/pi-hole#6601
• Loosen requirements for local file access for gravity by @​yubiuser in pi-hole/pi-hole#6430
• Fix permission for *.etag files after gravity run by @​yubiuser in pi-hole/pi-hole#6353
• add logrotate to DEB and RPM dependencies by @​darkexplosiveqwx in pi-hole/pi-hole#6524
• Improve gravity error message including curl exit code and errormsg by @​rdwebdesign in pi-hole/pi-hole#6605

Security advisories

• GHSA-6w8x-p785-6pm4
  • Fixed with : pi-hole/pi-hole@7ccb8dd and pi-hole/FTL@88c569a

Full Changelog: pi-hole/pi-hole@v6.4.1...v6.4.2

v2026.04.0

Compare Source

What's Changed (Docker Specific - all related to CI/build)

• Group dependabot PRs to reduce PR spam by @​yubiuser in #​2004
• ci: switch image publishing to docker/github-builder by @​crazy-max in #​2008
• Readme Rework by @​PromoFaux in #​1958
• Replace Python test suite with BATS and consolidate workflows by @​PromoFaux in #​2009
• Add timeout to curl command in branch validation by @​RynoCODE in #​2011
• Use bats-assert library functions in BATS test suite by @​Copilot in #​2018
• ci: run build job on pull request event by @​crazy-max in #​2021
• Update github-builder to v1.5.0 and enable fail-fast by @​yubiuser in #​2022

New Contributors

• @​crazy-max made their first contribution in #​2008
• @​RynoCODE made their first contribution in #​2011
• @​Copilot made their first contribution in #​2018

Full Changelog: pi-hole/docker-pi-hole@2026.02.0...2026.04.0

Component Release Notes

What's Changed (FTL v6.6)

• Fix possible resolver issue on armv5tel by @​DL6ER in pi-hole/FTL#2781
• Introduce CMake options for optional dependencies by @​aeolio in pi-hole/FTL#2795
• Fix build without mbedtls [v2] by @​aeolio in pi-hole/FTL#2796
• Fix overTime data when database.DBimport = false by @​DL6ER in pi-hole/FTL#2788
• Fix cross-compilation issues w/ custom toolchain by @​aeolio in pi-hole/FTL#2797
• Add new option for controling name resolution via MAC address by @​DL6ER in pi-hole/FTL#2790
• Fix obtaining client groups by name by @​DL6ER in pi-hole/FTL#2791
• Ensure API sessions are restored before starting the HTTP server by @​DL6ER in pi-hole/FTL#2803
• Add form-action 'self' to Content-Security-Policy by @​yubiuser in pi-hole/FTL#2804
• Add query_frequency to /padd endpoint by @​yubiuser in pi-hole/FTL#2806
• Guard query-count counters against unsigned underflow by @​DL6ER in pi-hole/FTL#2815
• Add universal crash backtrace via _Unwind_Backtrace by @​DL6ER in pi-hole/FTL#2811
• config: show totp_secret presence in CLI output by @​DL6ER in pi-hole/FTL#2813
• Fix client count inflation for rate-limited queries by @​DL6ER in pi-hole/FTL#2814
• Fix stack buffer overflow in get_process_name() by @​DL6ER in pi-hole/FTL#2821
• Do not restart FTL while pihole -g is still ongoing by @​DL6ER in pi-hole/FTL#2419

Security Advisories

• GHSA-r7g8-3fj7-m5qq - Authorization bypass: CLI API sessions can import Teleporter archives and modify configuration reported by @​mzalzahrani
• Remote Code Execution (RCE) via Newline Injection in Multiple Configuration Parameters reported by @​T0X1Cx
  • pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c
  • pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp
  • pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m
  • pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj
  • pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

New Contributors

• @​aeolio made their first contribution in pi-hole/FTL#2795

Full Changelog: pi-hole/FTL@v6.5...v6.6

What's Changed (Web v6.5)

• Amend teleporter help text that the long-term data is not included by @​yubiuser in pi-hole/web#3721
• Do not use 3 columns when boxed layout is used by @​rdwebdesign in pi-hole/web#3722
• Use ENTER instead of ⏎ by @​yubiuser in pi-hole/web#3727
• Don't link to github releases if docker tag is nightly by @​yubiuser in pi-hole/web#3718
• Do not try to compare component version when remote version info is not available by @​yubiuser in pi-hole/web#3729
• Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @​yubiuser in pi-hole/web#3742
• fix: check on responseJSON when wrong password by @​guybrush2105 in pi-hole/web#3693
• Remove the loggingButton from Settings > System > Actions by @​yubiuser in pi-hole/web#3747

Security Advisories

• Multiple Stored HTML Injections and XSS in different web interface pages reported by @​andrejtomci

  • GHSA-jx8x-mj2r-62vq - Stored HTML Injection in queries.js

  • GHSA-9rfm-c5g6-538p - Stored HTML attribute injection

  • GHSA-px6w-85wp-ww9v - Stored XSS / HTML injection in the Network page/Dashboard

  • GHSA-7xqw-r9pr-qv59 - Reflected XSS / HTML injection in taillog.js (Also reported by @​n1rwhex and @​mzalzahrani)

New Contributors

• @​guybrush2105 made their first contribution in pi-hole/web#3693

Full Changelog: pi-hole/web@v6.4.1...v6.5

What's Changed (Core v6.4.1)

• Remove additional ':' from debug log system time output by @​yubiuser in pi-hole/pi-hole#6551
• Remove readonly from piholeNetworkFlush.sh to avoid error message by @​rdwebdesign in pi-hole/pi-hole#6554
• Add antigravity index by @​DL6ER in pi-hole/pi-hole#6573
• Fix return status capture of FTL check_download exists by @​yubiuser in pi-hole/pi-hole#6572
• Remove misleading TODO comment for SetWebPassword by @​10adnan75 in pi-hole/pi-hole#6531

Security Advisories

• GHSA-c935-8g63-qp74 – Local Privilege Escalation reported by @​smittix

New Contributors

• @​10adnan75 made their first contribution in pi-hole/pi-hole#6531
• @​Copilot made their first contribution in pi-hole/pi-hole#6580

Full Changelog: pi-hole/pi-hole@v6.4...v6.4.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.