chore(deps): update container patch updates

.gitea/workflows/deploy-lib.sh

@@ -89,27 +89,10 @@ stage_validate() {
   cd "$REPO"
   select_manifests
   local m k cf
-  # Compose .env files and secret files are gitignored by design, so the
-  # workstation never has real values for them. Validate structure only:
-  # skip interpolation, env-file resolution, and path resolution so that
-  # required-variable guards (:?) and missing local files don't fail CI.
-  # Normalization and consistency checks stay enabled.
-  local compose_validate_flags=()
-  local compose_config_help
-  compose_config_help="$(docker compose config --help 2>/dev/null || true)"
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-interpolate'; then
-    compose_validate_flags+=(--no-interpolate)
-  fi
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-env-resolution'; then
-    compose_validate_flags+=(--no-env-resolution)
-  fi
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-path-resolution'; then
-    compose_validate_flags+=(--no-path-resolution)
-  fi
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    docker compose -f "$cf" config --quiet "${compose_validate_flags[@]}"
+    docker compose -f "$cf" config --quiet
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do

.gitea/workflows/deploy.yaml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: deploy-main
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 env:
   DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}

edu_master/k8s/alerts.yaml

@@ -11,14 +11,9 @@ spec:
       rules:
         # No successful webinar check for 5m (~2-3 missed 2-min checks).
         # Catches: playwright hangs/timeouts, version skew, site changes, hung job.
-        # The last_success > 0 guard is mandatory: checker.py initialises
-        # last_success to 0, so without it `time() - 0` equals the current epoch
-        # and humanizeDuration renders ~20722d on every pod restart. Keep the
-        # duration expression on the left so $value stays the real gap.
         - alert: WebinarCheckerNoSuccessfulCheck
           expr: |
-            ((time() - webinar_check_last_success_timestamp_seconds) > 300)
-              and (webinar_check_last_success_timestamp_seconds > 0)
+            (time() - webinar_check_last_success_timestamp_seconds > 300)
               and (webinar_check_last_run_timestamp_seconds > 0)
           for: 2m
           labels:
@@ -27,20 +22,6 @@ spec:
             summary: "Webinar checker has no successful check for 5m"
             description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
 
-        # Checks are running but none has ever succeeded since pod start.
-        # Split out from the rule above so a zeroed gauge never feeds
-        # humanizeDuration.
-        - alert: WebinarCheckerNeverSucceeded
-          expr: |
-            (webinar_check_last_success_timestamp_seconds == 0)
-              and (webinar_check_last_run_timestamp_seconds > 0)
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker has never completed a successful check"
-            description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
-
         # Fast path: 3 consecutive failures (~6+ min at 2-min interval).
         - alert: WebinarCheckerConsecutiveFailures
           expr: |

prometheus-stack/k8s/grafana-values.yaml

@@ -69,18 +69,3 @@ alertmanager:
 defaultRules:
   disabled:
     CPUThrottlingHigh: true
-    KubeControllerManagerDown: true
-    KubeSchedulerDown: true
-    KubeEtcdDown: true
-    KubeEtcdHighCommitDurations: true
-
-# k0s runs controller-manager/scheduler/etcd internally, not as pods with
-# component=kube-controller-manager/kube-scheduler/k8s-app=kube-etcd labels.
-# Their Services get no endpoints, so the targets are permanently down.
-# kube-proxy and kubelet have endpoints on k0s, keep them enabled.
-kubeControllerManager:
-  enabled: false
-kubeScheduler:
-  enabled: false
-kubeEtcd:
-  enabled: false

searxng/compose.yaml

@@ -3,7 +3,7 @@
 services:
   core:
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.9.25-12f8b6515}
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.09.13-d4ce87c23}
     restart: unless-stopped
     # ports:
     # - ${SEARXNG_PORT:-8080}

searxng/k8s/searxng.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: searxng
-          image: docker.io/searxng/searxng:2026.9.25-12f8b6515
+          image: docker.io/searxng/searxng:2026.09.13-d4ce87c23
           envFrom:
             - configMapRef:
                 name: searxng-config