Update docker.io/pihole/pihole Docker tag to v2026

[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/pihole/pihole	major	2025.11.1 → 2026.04.0

---

Release Notes

pi-hole/docker-pi-hole (docker.io/pihole/pihole)

v2026.04.0

Compare Source

What's Changed (Docker Specific - all related to CI/build)

• Group dependabot PRs to reduce PR spam by @​yubiuser in #​2004
• ci: switch image publishing to docker/github-builder by @​crazy-max in #​2008
• Readme Rework by @​PromoFaux in #​1958
• Replace Python test suite with BATS and consolidate workflows by @​PromoFaux in #​2009
• Add timeout to curl command in branch validation by @​RynoCODE in #​2011
• Use bats-assert library functions in BATS test suite by @​Copilot in #​2018
• ci: run build job on pull request event by @​crazy-max in #​2021
• Update github-builder to v1.5.0 and enable fail-fast by @​yubiuser in #​2022

New Contributors

• @​crazy-max made their first contribution in #​2008
• @​RynoCODE made their first contribution in #​2011
• @​Copilot made their first contribution in #​2018

Full Changelog: pi-hole/docker-pi-hole@2026.02.0...2026.04.0

Component Release Notes

What's Changed (FTL v6.6)

• Fix possible resolver issue on armv5tel by @​DL6ER in pi-hole/FTL#2781
• Introduce CMake options for optional dependencies by @​aeolio in pi-hole/FTL#2795
• Fix build without mbedtls [v2] by @​aeolio in pi-hole/FTL#2796
• Fix overTime data when database.DBimport = false by @​DL6ER in pi-hole/FTL#2788
• Fix cross-compilation issues w/ custom toolchain by @​aeolio in pi-hole/FTL#2797
• Add new option for controling name resolution via MAC address by @​DL6ER in pi-hole/FTL#2790
• Fix obtaining client groups by name by @​DL6ER in pi-hole/FTL#2791
• Ensure API sessions are restored before starting the HTTP server by @​DL6ER in pi-hole/FTL#2803
• Add form-action 'self' to Content-Security-Policy by @​yubiuser in pi-hole/FTL#2804
• Add query_frequency to /padd endpoint by @​yubiuser in pi-hole/FTL#2806
• Guard query-count counters against unsigned underflow by @​DL6ER in pi-hole/FTL#2815
• Add universal crash backtrace via _Unwind_Backtrace by @​DL6ER in pi-hole/FTL#2811
• config: show totp_secret presence in CLI output by @​DL6ER in pi-hole/FTL#2813
• Fix client count inflation for rate-limited queries by @​DL6ER in pi-hole/FTL#2814
• Fix stack buffer overflow in get_process_name() by @​DL6ER in pi-hole/FTL#2821
• Do not restart FTL while pihole -g is still ongoing by @​DL6ER in pi-hole/FTL#2419

Security Advisories

• GHSA-r7g8-3fj7-m5qq - Authorization bypass: CLI API sessions can import Teleporter archives and modify configuration reported by @​mzalzahrani
• Remote Code Execution (RCE) via Newline Injection in Multiple Configuration Parameters reported by @​T0X1Cx
  • pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c
  • pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp
  • pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m
  • pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj
  • pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

New Contributors

• @​aeolio made their first contribution in pi-hole/FTL#2795

Full Changelog: pi-hole/FTL@v6.5...v6.6

What's Changed (Web v6.5)

• Amend teleporter help text that the long-term data is not included by @​yubiuser in pi-hole/web#3721
• Do not use 3 columns when boxed layout is used by @​rdwebdesign in pi-hole/web#3722
• Use ENTER instead of ⏎ by @​yubiuser in pi-hole/web#3727
• Don't link to github releases if docker tag is nightly by @​yubiuser in pi-hole/web#3718
• Do not try to compare component version when remote version info is not available by @​yubiuser in pi-hole/web#3729
• Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @​yubiuser in pi-hole/web#3742
• fix: check on responseJSON when wrong password by @​guybrush2105 in pi-hole/web#3693
• Remove the loggingButton from Settings > System > Actions by @​yubiuser in pi-hole/web#3747

Security Advisories

• Multiple Stored HTML Injections and XSS in different web interface pages reported by @​andrejtomci

  • GHSA-jx8x-mj2r-62vq - Stored HTML Injection in queries.js

  • GHSA-9rfm-c5g6-538p - Stored HTML attribute injection

  • GHSA-px6w-85wp-ww9v - Stored XSS / HTML injection in the Network page/Dashboard

  • GHSA-7xqw-r9pr-qv59 - Reflected XSS / HTML injection in taillog.js (Also reported by @​n1rwhex and @​mzalzahrani)

New Contributors

• @​guybrush2105 made their first contribution in pi-hole/web#3693

Full Changelog: pi-hole/web@v6.4.1...v6.5

What's Changed (Core v6.4.1)

• Remove additional ':' from debug log system time output by @​yubiuser in pi-hole/pi-hole#6551
• Remove readonly from piholeNetworkFlush.sh to avoid error message by @​rdwebdesign in pi-hole/pi-hole#6554
• Add antigravity index by @​DL6ER in pi-hole/pi-hole#6573
• Fix return status capture of FTL check_download exists by @​yubiuser in pi-hole/pi-hole#6572
• Remove misleading TODO comment for SetWebPassword by @​10adnan75 in pi-hole/pi-hole#6531

Security Advisories

• GHSA-c935-8g63-qp74 – Local Privilege Escalation reported by @​smittix

New Contributors

• @​10adnan75 made their first contribution in pi-hole/pi-hole#6531
• @​Copilot made their first contribution in pi-hole/pi-hole#6580

Full Changelog: pi-hole/pi-hole@v6.4...v6.4.1

v2026.02.0

Compare Source

What's Changed (Docker Specific)

• Pin base image by sha to catch silent rebuilds by @​yubiuser in #​1965
• Set fixed buildx version to mitigate issues with buildx version 0.31.1 by @​yubiuser in #​1987

Full Changelog: pi-hole/docker-pi-hole@2025.11.1...2026.02.0

---

What's Changed (FTL v6.5)

• Tweak undocumented wait-for option subtly by @​DL6ER in pi-hole/FTL#2707
• update gravity - improve domain validation processing speed by @​rrobgill in pi-hole/FTL#2710
• Update embedded SQLite3 to 3.51.1 by @​DL6ER in pi-hole/FTL#2731
• Update embedded dnsmasq to 2.92rc1 by @​DL6ER in pi-hole/FTL#2730
• Fix documentation - Do not use equal sign with pihole-FTL --config command by @​rdwebdesign in pi-hole/FTL#2736
• Add dns.cache.rrtype by @​Manakuremati in pi-hole/FTL#2740
• Enhancements to the documentation markdown generator by @​PromoFaux in pi-hole/FTL#2741
• Network Overview - obtain MAC and hostname from dhcp.leases by @​rrobgill in pi-hole/FTL#2727
• fix: make get_domains parameters optional by @​tien in pi-hole/FTL#2278
• Escape unprintable characters in invalid host names by @​DL6ER in pi-hole/FTL#2601
• Implement better allOf handling in API verifier by @​DL6ER in pi-hole/FTL#2745
• Update build containers to Alpine 3.23 by @​DL6ER in pi-hole/FTL#2743
• Add option to hide network connection errors by @​DL6ER in pi-hole/FTL#2749
• Harden default Content Security Policy (CSP) by @​Erasure5959 in pi-hole/FTL#2754
• Fix computation of NTP server's root delay by @​DL6ER in pi-hole/FTL#2760
• Teleporter: Fix for custom gravity.db path by @​DL6ER in pi-hole/FTL#2758
• Upgrade embedded Lua to 5.5 by @​DL6ER in pi-hole/FTL#2626
• Add missing [forwarded] property in GET /api/history/database by @​DL6ER in pi-hole/FTL#2750
• Update SQLite3 to 3.51.2 by @​DL6ER in pi-hole/FTL#2761
• Low-memory hardware optimizations by @​DL6ER in pi-hole/FTL#2757
• Reduce startup delay by @​DL6ER in pi-hole/FTL#2725
• home.arpa and internal TLDs may be non-local without revServer by @​DL6ER in pi-hole/FTL#2772

New Contributors

• @​Erasure5959 made their first contribution in pi-hole/FTL#2754

Full Changelog: pi-hole/FTL@v6.4.1...v6.5

What's Changed (Web v6.4.1)

• Set the end date for live query update to end of epoch by @​rrobgill in pi-hole/web#3677
• Improve initial loading of Query Log by @​DL6ER in pi-hole/web#3715

Also fixes two security advisories:

• GHSA-6xp4-jw73-f4qp: fixed with pi-hole/web@d328f14
• GHSA-8rw8-vjgp-rwj6: fixed with pi-hole/web@1a0c6f4

Full Changelog: pi-hole/web@v6.4...v6.4.1

What's Changed (Core v6.4)

• Remove wget from alpine dependencies by @​darkexplosiveqwx in pi-hole/pi-hole#6484
• Remove custom FTL FirewallD zone checks from debug log by @​rdwebdesign in pi-hole/pi-hole#6481
• Add Alpine 3.23 to test suite by @​yubiuser in pi-hole/pi-hole#6488
• Debug log - Add colors to gravity tables by @​rdwebdesign in pi-hole/pi-hole#6485
• Use configured location for web repo when updating or repairing by @​rrobgill in pi-hole/pi-hole#6470
• Add missing -g to the message in gravity recovery command by @​rdwebdesign in pi-hole/pi-hole#6513
• Don't install unused /usr/local/share/man/man5 by @​darkexplosiveqwx in pi-hole/pi-hole#6526

Full Changelog: pi-hole/pi-hole@v6.3...v6.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 2026.x releases. But if you manually upgrade to 2026.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.