# Renovate automerge whitelist for localApps.
# Admission policy:
# - Prefer single-service apps whose compose shape has stayed stable across recent store versions.
# - Require recent Renovate/app-version updates to be image-only in practice; avoid apps that recently needed maintainer runtime/package repair.
# - Multi-service apps stay out by default; use renovate-primary-services.json plus tested maintainer review instead.
# - Host network / privileged / device-heavy apps need stronger manual review before being added.
# See .github/renovate-automerge-whitelist-policy.md and
# .github/scripts/renovate_whitelist_audit.py for the maintainer workflow.
upsnap
code-server
zeroclaw
dpanel
wallos
chatgpt-on-wechat
audiobookshelf
cloudbeaver
dbgate
frigate
openclaw
moviepilot
sonarr
gopeed
passwordpusher
flexget
peerbanhelper
ddns-go
element-web
verdaccio
lobe-chat
nezha-dash
picimpact
tianji
certimate
certd
clouddrive
seatable
seafile
domain-admin
blinko
ikaros
siyuan
mt-photos
nginxwebui
2fauth
adguardhome
palworld-server
bytebase
prometheus
pgadmin4
cloudflared
duplicati
bililive-go
easynode
filebrowser
hertzbeat
onedev
pingvin-share
grafana
homepage
frpc
frps
syncclipboard-server
redisinsight
act_runner
pagespy
synapse
nextcloud
linkding
syncthing
jellyfin
vocechat
lucky
bitwarden
onlyoffice
tailscale
nezha-dashboard
spider-admin-pro
zdir
deeplx
v2raya
glance
firefox-browser
synapse-admin
radarr
sub2sing-box
telegram
joplin-server
cli-proxy-api
anqicms
atvloadly
rembg
cashbook
autobangumi
azahar-linuxserver
pterodactyl-china
beszel
beszel-agent
calibre-web
remmina
dashy
slink
ntfy
cloudreve
changedetectionio
gotify
mdc-ng
piclist
mediawiki
plex
answer
artalk
autoheal
baidunetdisk
bark
bililive-recorder
blossom
chatgpt-next-web
chevereto
chinesesubfinder
chrome-browser
cook
cookiecloud
cpa-usage-keeper
deluge
discussion
discuz
docker-mirror-monitor
dockge
dweebui
easyimage2
easytier
edge-browser
emby-amilys
firefly
flaresolverr
flarum
focalboard
freshrss
frp-panel
frp-panel-master
geekbench
h5ai
headscale
heimdall
hivision-id-photo
home-assistant
icat_lite
it-tools
joplin
kkfileview
kms-web
laftools
langchain-chatchat
lanraragi
libreoffice
librespeed
libretv
linux-command
lrcapi
maddy-mail
mattermost
mcsmanager-daemon
mcsmanager-web
mdcx
medama
memcached
metapi
metatube-sdk-go
mi-gpt
mi-gpt-gui
minichat
modstartblog
modstartcms
moments
moments1
mosdns
mt-photos-ai
mt-photos-deepface
mtab
music-tag-web
mynodequery
nas-tools
natter
netdata
nginx-ui
nodebb
npc
nps
nvpress
obsidian-zh
onenav
openlist
openlitespeed
openspeedtest
perfree-blog
photoprism
photoview
phtunnel
pic-smaller
port-forward-agent
port-forward-server
qBittorrent
qbittorrent-vnc
qiandao
rathole
resilio-sync
roundcube
rss-reader
rss-to-telegram-bot
samba
searxng
serverstatus
slash
smokeping
splayer
sqlitebrowser
sscms
stackedit
stash
streaming-media-server-pro
sub2api
sub2clash
subconverter
sun-panel
talebook
thunderbird
thunderbird-kasm
transmission
trilium
trilium-cn
unblockneteasemusic
van-nav
vanblog
watchtower
webos
wewe-rss
windows
wireguard
blender-linuxserver
forwardx
commafeed
whois
dagu
deepseek-harness-workstation
nora
centrifugo
litellm
weaviate
infinite-canvas
openobserve
wol-go-web
xunlei
yesplaymusic
yourls
zabbix-agent
zfile
# LinuxServer apps with passed latest+fixed smoke reports and unchanged upstream compose fields since 2025-06-27.
adguardhome-sync-linuxserver
airsonic-advanced-linuxserver
apprise-api-linuxserver
babybuddy-linuxserver
bazarr-linuxserver
beets-linuxserver
budge-linuxserver
changedetection.io-linuxserver
cops-linuxserver
davos-linuxserver
ddclient-linuxserver
dokuwiki-linuxserver
doplarr-linuxserver
duckdns-linuxserver
duplicati-linuxserver
emby-linuxserver
fail2ban-linuxserver
ferdium-linuxserver
flexget-linuxserver
foldingathome-linuxserver
freshrss-linuxserver
grav-linuxserver
grocy-linuxserver
habridge-linuxserver
hishtory-server-linuxserver
homeassistant-linuxserver
htpcmanager-linuxserver
jackett-linuxserver
jellyfin-linuxserver
kavita-linuxserver
lazylibrarian-linuxserver
ldap-auth-linuxserver
librespeed-linuxserver
lidarr-linuxserver
luanti-linuxserver
lychee-linuxserver
medusa-linuxserver
modmanager-linuxserver
mstream-linuxserver
mylar3-linuxserver
nginx-linuxserver
ngircd-linuxserver
nzbget-linuxserver
nzbhydra2-linuxserver
ombi-linuxserver
openssh-server-linuxserver
openvscode-server-linuxserver
oscam-linuxserver
overseerr-linuxserver
pairdrop-linuxserver
phpmyadmin-linuxserver
piwigo-linuxserver
projectsend-linuxserver
prowlarr-linuxserver
pwndrop-linuxserver
pyload-ng-linuxserver
qbittorrent-linuxserver
raneto-linuxserver
rsnapshot-linuxserver
rustdesk-linuxserver
sabnzbd-linuxserver
series-troxide-linuxserver
sickgear-linuxserver
socket-proxy-linuxserver
synclounge-linuxserver
syslog-ng-linuxserver
tautulli-linuxserver
telegram-linuxserver
thelounge-linuxserver
tvheadend-linuxserver
ubooquity-linuxserver
webgrabplus-linuxserver
wikijs-linuxserver
winegui-linuxserver
xbackbone-linuxserver
znc-linuxserver
# Apps with official GitHub compose/deployment fields unchanged since 2025-06-27 and no high-risk compose flags.
alist
aria2-pro
chatnio
filecodebox
gowebdav
myip
navidrome
reubah
sublink
twikoo
vps-stock-monitor
web-check
# Single-service Renovate image-only updates. The workflow still blocks compose structure changes.
opera-linuxserver
netbootxyz-linuxserver
kdenlive-linuxserver
boinc-linuxserver
shotcut-linuxserver
modrinth-linuxserver
faster-whisper-linuxserver
calibre-linuxserver
bambustudio-linuxserver
blade-of-agony-linuxserver
brave-linuxserver
gotosocial
dbx
msedge-linuxserver
zotero-linuxserver
zen-linuxserver
rawtherapee-linuxserver
qdirstat-linuxserver
pycharm-linuxserver
orcaslicer-linuxserver
mullvad-browser-linuxserver
melonds-linuxserver
librewolf-linuxserver
healthchecks-linuxserver
flycast-linuxserver
chrome-linuxserver
darktable-linuxserver
ungoogled-chromium-linuxserver
signal-linuxserver
thunderbird-linuxserver
ting-reader
vscode-linuxserver

# Reviewed single-service Renovate candidates (2026-07-19).
cpa-manager-plus
ech0
flipt
helium-linuxserver
wakapi

# Reviewed single-service Renovate candidates (2026-08-01).
codex2api
opencode

# Reviewed digest-only Renovate candidates (2026-08-07).
podfetch
isrvd
chromium-kasm
filezilla-kasm
firefox-kasm
insomnia-kasm
only-office-kasm
postman-kasm
signal-kasm
slack-kasm
vlc-kasm
audacity-kasm
blender-kasm
brave-kasm
gimp-kasm
inkscape-kasm
obsidian-kasm
pinta-kasm
remmina-kasm
sublime-text-kasm
vivaldi-kasm

# Reviewed single-service Renovate candidates (2026-08-10).
filerise
hermitstash
pulse

# Reviewed single-service Renovate candidates (2026-08-21).
librarr
webclaw

# Reviewed single-service Renovate candidates (2026-09-07).
moltis

# Reviewed single-service LinuxServer Renovate candidates (2026-10-31).
audacity-linuxserver
speedtest-tracker-linuxserver

# Explicit owner-requested exception; retain the normal shape and security gates.
1panel

# Reviewed 2026-10-29: stable single-service compose and image-only Renovate history.
# No special runtime flags, recent maintainer repairs, or open PR at admission.
immich-kiosk
kanboard
mediamtx
resin
shlink
silverbullet
xiaomi-album-syncer

# Reviewed 2026-10-29: #8029 exact upgrade smoke and secret checks passed; stable single-service shape.
# CVE scan deferred at owner request; future PRs remain subject to the workflow's image-only and shape gates.
pdfding

# Reviewed 2026-10-29 after #8012: stable single-service shape; recent Renovate updates are image-only; exact upgrade smoke to v4.0.20 and source secret scan passed. CVE status remains unassessed.
imgproxy

# Reviewed 2026-10-31: stable single-service Compose, no special runtime flags, and recent merged
# Renovate image updates. PRs changed the Compose image; other package files were unchanged moves
# into new version directories where applicable.
# Evidence: #7333, #7117, #7832, #7809, #7643, #7813/#7814, and #6755.
freecad-linuxserver
intellij-idea-linuxserver
onlyoffice-linuxserver
pcsx2-linuxserver
scummvm-linuxserver
vlc-linuxserver
vscodium-linuxserver
vscodium-web-linuxserver

# Kept out after review: Yaak needed recent source-trust/rebuild work (#6397/#6983); Audacity had a
# source-trust correction (#6401); Piper needed package maintenance (#6083); Speedtest Tracker had
# recent init/upgrade maintenance; Krita needed a maintainer rebuild (#6939); MariaDB is stateful;
# Altus #4968 changed README/security guidance beyond the image update. All 24 KasmWeb app packages
# are already listed.

# Reviewed 2026-10-31: single-service Compose shape, no special runtime permissions, and merged
# Renovate PRs changed only the image while leaving the packaged app files unchanged or moved.
# Evidence: #6244 (DOSBox Staging), #5395/#5771/#5831 (Obsidian), #4864/#6958 (Vivaldi), and
# #5935 (Webcord). Upgrade scripts remain unchanged by these image updates.
dosbox-staging-linuxserver
obsidian-linuxserver
vivaldi-linuxserver
webcord-linuxserver

# Reviewed 2026-10-31: separate BabyBuddy and Grocy package keys using the lscr.io alias have
# stable single-service Compose shapes, no special flags, and their own image-only Renovate history.
# Evidence: #5649/#6776/#7062 (BabyBuddy) and #6494 (Grocy).
babybuddy
grocy

# Reviewed 2026-11-01: stable single-service Compose, image-only Renovate history,
# no special runtime flags or recent package repairs. #8157 upgrade smoke passed
# on the exact PR tree (2.8.10 package directory with image tag 2.8.11); CVE remains unassessed.
bentopdf

# Reviewed 2026-11-03: stable single-service Compose shapes, image-only Renovate updates,
# no special runtime permissions or recent package repairs; exact upgrade smoke passed on
# #8106 (Trailbase), #8125 (Downtify), #8130 (OliveTin), and #8141 (GoModel). CVE scans
# were not run; see the task-local reports and parameter notes for bound evidence.
downtify
gomodel
olivetin
trailbase
stump

# Reviewed 2026-11-04: stable single-service shape; #6357 and #8181 were image-only Renovate updates.
# #8181 exact upgrade smoke and source secret scan passed; CVE scan was intentionally not run.
actual-budget
# Reviewed 2026-11-04: stable single-service Compose shapes, image-only Renovate updates,
# no special runtime flags or recent package repairs; exact upgrade smoke passed on #8193 and #8195.
# CVE scans were skipped; see task-local parameter notes and bound reports.
drawdb
hitkeep

# Reviewed 2026-11-06: single-service LinuxServer Cura image-only update (#8318), stable Compose shape, and no special runtime permissions. The existing upgrade script only fills missing/empty environment defaults.
cura-linuxserver
