chore(deps): update ghcr.io/ozark-connect/network-optimizer docker tag to v1.12.7

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/ozark-connect/network-optimizer	patch	1.12.6 → 1.12.7

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Ozark-Connect/NetworkOptimizer (ghcr.io/ozark-connect/network-optimizer)

v1.12.7

Compare Source

More audit accuracy fixes, especially around DNS and 802.1X. See v1.12.0 release notes for what's new in v1.12.0+

Security Audit

• DNS audit false positive fixes - Inverted source address rules (e.g., "not 192.168.1.220") were incorrectly flagged as single-IP DNAT coverage. These rules cover all networks except one IP, which is effectively full coverage. Also fixed handling of firewall address/port groups and invert_address in DNAT analysis.
• VLAN isolation no longer flags DNS-only rules - Cross-VLAN rules limited to port 53 (UDP or TCP+UDP) are now exempt from isolation bypass warnings, since Pi-hole cross-VLAN access is legitimate.
• DNS IP consistency check - Networks using a different third-party DNS IP than the majority now get flagged, helping catch misconfigurations. Gateway IPs and Corporate networks are excluded to avoid false positives.
• Pi-hole/AdGuard Home detection improvements - The management endpoint setting now accepts a full URL (e.g., https://pihole.local) in addition to a port number, for users behind a reverse proxy. Internal probing also skips SSL cert validation since container-internal certs aren't trusted.
• Multi-CIDR firewall group coverage - DNAT analysis now checks all CIDRs from firewall address groups instead of just the first, fixing false "Partial DNAT Coverage" warnings for multi-subnet groups.
• 802.1X port placement fixed - Camera and IoT VLAN rules now use the client's effective network ID for 802.1X/RADIUS-secured ports instead of the unauthenticated VLAN config. Ports with no connected client are skipped since the RADIUS-assigned VLAN can't be determined.

Config Optimizer

• Co-channel interference scaled for dense deployments - When a floor plan is set up and APs outnumber the non-overlapping channels for the band, co-channel warnings downgrade to Info severity since some overlap is unavoidable.

Fixes

• Third-party DNS detector no longer false-positives on malformed JSON - Previously, a JSON parse failure could trigger a false "detected" result if the response body happened to contain the string "dns".
• Settings validation - Invalid DNS endpoint input now shows validation feedback instead of silently failing.

Installation

Windows: Download the MSI installer below

Docker:

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh

# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"

For other platforms (Synology, QNAP, Unraid, native Linux), see the Deployment Guide.

---

Configuration

📅 Schedule: Branch creation - Every minute ( * */1 * * * ) in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.