feat(container): update ghcr.io/home-operations/tautulli ( 2.16.1 ➔ 2.17.1 )

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/tautulli (source)	minor	2.16.1 → 2.17.1

---

Release Notes

Tautulli/Tautulli (ghcr.io/home-operations/tautulli)

v2.17.1

Compare Source

• Notifications:
  • Fix: Tautulli Remote App notifications failing to send. (#​2669)
  • New: Added extra type and preroll to notification parameters.
  • New: Added Simkl URL to notification parameters.
• Newsletters:
  • Fix: Remote code execution via newsletter custom template directory. (CVE-2026-41065) (Thanks @​remindsec)
• Exporter:
  • Fix: Export failed when logo / square art keys were included. (#​2685)
• UI:
  • Fix: Error when browsing for folder paths. (#​2673)
  • New: Added AV1 media flag image. (#​2676) (Thanks @​little0831)
  • New: Added opus media flag image.
• Other:
  • Fix: Clean empty directories after updating using git. (#​2667)
  • Fix: Tautulli failing to reconnect to Plex Media Server until restarted after a connection loss at startup. (#​2640)
  • Fix: Path treversal in cache deletion API. (CVE-2026-40605) (Thanks @​JakePeralta7)
  • Fix: Websocket not exiting and reconnecting cleanly after changing Plex servers.
  • Fix: Sanitize JS log errors to prevent XSS. (CVE-2026-43984) (Thanks @​larlarua)
  • Fix: Do not store image hash for external images. (CVE-2026-43986) (Thanks @​larlarua)
  • New: Update Windows and MacOS packages to Python 3.13.
  • New: Update Snap package to core24.
  • New: Using mounted folders for custom newsletter templates and scripts requires manually enabling allow_mounted_folders = 1 in the config file.
  • New: Added anti-CSRF tokens and enforce POST methods to state change endpoints. (CVE-2026-43985) (Thanks @​larlarua)
  • New: Hash Tautulli cookie name. All existing login sessions will be invalidated after the update.
  • New: Require X-Api-Key header for login through the /auth/signin endpoint.

v2.17.0

Compare Source

• Important Note!
  • Several security vulnerabilities have been identified in Tautulli versions <=2.16.1. Users are strongly encouraged to update to the latest Tautulli version 2.17.x.
• Notifications:
  • Fix: Prevent RCE in notification text evaluation. (CVE-2026-28505) (Thanks @​q1uf3ng)
• Newsletters:
  • Fix: Media from other video libraries using the modern Plex agents not showing up on newsletter.
  • Fix: Unauthenticated path traversal in /newsletter/image/images endpoint. (CVE-2026-31831) (Thanks @​JakePeralta7)
• Exporter:
  • Fix: Logo images incorrectly exported as jpg instead of png.
  • New: Added ability to export square art images.
  • New: Added ability to export theme music. (#​2654)
• Graphs:
  • Fix: History modal not opening when clicking on graphs. (#​2652)
• API:
  • Fix: SQL injection in get_home_stats API command. (CVE-2026-31799) (Thanks @​mandreko)
  • Fix: Unsanitized JSONP callback parameter. (CVE-2026-32275) (Thanks @​mandreko)
  • New: Added rating to get_home_stats API command. (#​2655) (Thanks @​jma1ice)
  • Removed: get_apikey API command.
• Other:
  • Fix: Validate log path for Plex log files. (#​2632)
  • Fix: Add authentication to /pms_image_proxy endpoint. (CVE-2026-31804) (Thanks @​mandreko)
  • New: Updated third party donation logos. (#​2646) (Thanks @​aisgbnok)
  • New: Update Bootstrap CSS to v3.4.1 and decouple overrides. (#​2662) (Thanks @​aisgbnok)
  • New: Update Bootstrap-select to v1.13.18. (#​2666) (Thanks @​aisgbnok)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[kreigan-assistant]

--- kubernetes/apps/media/tautulli/app Kustomization: media/tautulli HelmRelease: media/tautulli

+++ kubernetes/apps/media/tautulli/app Kustomization: media/tautulli HelmRelease: media/tautulli

@@ -18,13 +18,13 @@

     controllers:
       tautulli:
         containers:
           app:
             image:
               repository: ghcr.io/home-operations/tautulli
-              tag: 2.16.1
+              tag: 2.17.1
             probes:
               liveness:
                 custom: true
                 enabled: true
                 spec:
                   failureThreshold: 3

[kreigan-assistant]

--- HelmRelease: media/tautulli Deployment: media/tautulli

+++ HelmRelease: media/tautulli Deployment: media/tautulli

@@ -36,13 +36,13 @@

         runAsUser: 2000
       hostIPC: false
       hostNetwork: false
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-      - image: ghcr.io/home-operations/tautulli:2.16.1
+      - image: ghcr.io/home-operations/tautulli:2.17.1
         livenessProbe:
           failureThreshold: 3
           httpGet:
             path: /status
             port: 8181
           initialDelaySeconds: 0