fix(container): update image ghcr.io/usetrmnl/trmnl-ha-amd64 (0.9.0 → 0.9.1)

[smurf-bot]

This PR contains the following updates:

Package	Update	Change
ghcr.io/usetrmnl/trmnl-ha-amd64	patch	0.9.0 → 0.9.1

---

Release Notes

usetrmnl/trmnl-home-assistant (ghcr.io/usetrmnl/trmnl-ha-amd64)

v0.9.1

Compare Source

Added

• timestamp_12h add-on option (TIMESTAMP_12H environment variable in standalone) to render the capture-time overlay in 12-hour AM/PM format instead of the 24-hour default (#​68)

Changed

• Webhook connection failures now name the unreachable host and point at the usual culprit — local hostnames that don't resolve inside the add-on container (#​71)
• The preview's over-50KB warning is now spelled out next to the file size instead of hiding in a hover tooltip — oversized images can crash-loop TRMNL devices (#​70)

Fixed

• Orphaned Chromium/crashpad processes are now reaped: the container runs under tini as PID 1, so periodic browser restarts no longer accumulate zombie processes (#​72)
• A failed BYOS token refresh no longer discards the stored access token, which turned a refresh 400 (Terminus rotates refresh tokens on use) into an unauthenticated push and a 401 on nearly every scheduled cycle. The push now falls back to the stored token, which stock Terminus keeps valid (#​75)
• BYOS URI delivery no longer renders every dashboard twice: the URI sent to the BYOS server now points at the capture saved by that run (served at /output/), instead of a live screenshot endpoint that triggered a second full Chromium render when fetched (#​74)
• Dashboard paths with query params like Kiosk Mode's ?kiosk no longer fail with HTTP 400: previews join system params with & instead of a second ?, and unknown query params on screenshot requests are forwarded to the Home Assistant page URL instead of being dropped (#​44)
• WebSocket-driven cards (weather forecasts, render templates) intermittently rendered empty when the HA frontend lost its subscribeMessage registration race and discarded the subscription data. Navigation now watches for the orphaned-subscription console warning and soft-retries by re-mounting the panel on the live page, preserving the warm WebSocket connection that wins the race — thanks @​michael-fritzsch (#​55)
• "Send Now" on a disabled schedule no longer deletes the capture it just saved when no other schedules are enabled — the retention limit previously computed to zero files

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[smurf-bot]

konflate — summary

Note

✅ No rendered changes.

View the full rendered diff →

_{konflate · rendered 9d77c81 · advisory, not a gate}

[its-saffron]

AI Automated Review

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR PR 8378 — trmnl-ha container update (0.9.0 → 0.9.1)

Recommendation: Approve.

This is a straightforward container image patch bump. The diff shows only a single line change — the image tag from 0.9.0@sha256:… to 0.9.1@sha256:… — with no HelmRelease structure or values changes.

Required Checks — Explicit Verification

1. Validate manifest against target cluster version ✅

• The HelmRelease uses apiVersion: helm.toolkit.fluxcd.io/v2 — this is the standard Flux v2 API, supported by all clusters this base overlay targets (main, utility, test).
• The app-template chart schema (helmrelease-helm-v2.schema.json) is correctly referenced via $schema.
• No API version, CRD, or deprecated field changes are present in the diff.
• The upgrade-impact evidence provider reported no manifest-level issues.

2. Check for resource quota / limit changes ✅

• Resource requests: cpu: 25m, memory: 512Mi — unchanged from 0.9.0.
• Resource limits: memory: 1Gi — unchanged from 0.9.0.
• No LimitRange, ResourceQuota, or PodDisruptionBudget changes exist in this diff.
• The resources block is present and consistent across both versions.

Upstream Release Quality

The v0.9.1 release is a well-scoped patch with 11 commits covering:

• Process management fix: The container now runs under tini as PID 1 to reap orphaned Chromium/crashpad children, eliminating zombie process accumulation from periodic browser restarts.
• Authentication fix: Failed BYOS token refreshes no longer discard the stored access token, preventing 401 errors on nearly every scheduled cycle.
• Efficiency fix: BYOS URI delivery now points at the saved capture file (/output/) instead of re-rendering via a live screenshot endpoint, eliminating double Chromium passes.
• Robustness fixes: Kiosk Mode query params (?kiosk) no longer cause HTTP 400; WebSocket-driven cards no longer intermittently render empty due to a subscription race condition; disabled-schedule "Send Now" no longer deletes the capture it just saved.
• UX improvements: 12-hour timestamp overlay option, clearer webhook error messages, explicit over-50KB file-size warnings.

All fixes are internal correctness improvements with no behavior-breaking changes to the configured values. The HOME_ASSISTANT_URL, TZ, secret reference, persistence, route, and probe configurations are all identical.

Standards Compliance

Standard	Status
metadata.namespace absent on HelmRelease	✅ Intentional per AGENTS.md convention
OCIRepository defined per-app alongside HelmRelease	✅ spec.chartRef references local OCIRepository named trmnl-ha
spec.interval set	✅ 15m
Image pinned by @sha256:	✅ 016070abcea00fcba47f9d79d7440cf168e78d1d2012e97159d883197140479b
Registry allowlisted (GHCR.io)	✅
Security context hardening (drop ALL, no privilege escalation)	✅
No plain-text secrets	✅ envFrom references {{ .Release.Name }} external-secret

Evidence Summary

• CI checks: All passed (Image Pull across main/utility, Konflate render).
• konflate-rendered-diff: No findings — clean render.
• upgrade-impact: Confirmed image-only change with unchanged HelmRelease values.
• GitHub compare metadata: 11 commits, all internal fixes — no migration or breaking change risk.

No blockers. Safe to merge.