Update renovate/renovate Docker tag to v44.210.1

.gitea/workflows/renovate.yml

@@ -21,7 +21,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:44.199.2
+            renovate/renovate:44.210.1
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the

package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@larvit/log": "2.3.0",
         "ejs": "6.0.1",
-        "lucide-static": "1.70.0",
+        "lucide-static": "1.66.0",
         "postgres": "3.4.9"
       },
       "devDependencies": {
@@ -421,9 +421,9 @@
       }
     },
     "node_modules/lucide-static": {
-      "version": "1.70.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.70.0.tgz",
-      "integrity": "sha512-A9UgY98g94IuHQY7rl7/AFwHX7T1qNpzryim+Kw5CGhdV2STobtBY+ib/Z44ohyqXEJB88gvXFAeJ87uOOHKLw==",
+      "version": "1.66.0",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.66.0.tgz",
+      "integrity": "sha512-j8Bjf/f21PtlD8p0wx1lRxyOrs98WZ1QEImkWmfskuJ8mOCwTN7Dwc6EHUzJDSzh79aB+Bo7SWcoTCM2zEjnJg==",
       "license": "ISC"
     },
     "node_modules/postgres": {

package.json

@@ -18,7 +18,7 @@
   "dependencies": {
     "@larvit/log": "2.3.0",
     "ejs": "6.0.1",
-    "lucide-static": "1.70.0",
+    "lucide-static": "1.66.0",
     "postgres": "3.4.9"
   },
   "devDependencies": {

todo.md

@@ -6,7 +6,7 @@
 
 `Bar = 1`
 
-`Next ID = 58`
+`Next ID = 57`
 
 ## Items
 
@@ -17,7 +17,6 @@
 | 6 | 0.5.0 |  |  | **Warn at discovery when a route or nav node gates on a permission no plugin declares.** | 2 | 1 | 1 | 2 | 2 | 7 by 3, 9 by 3 | 8.0 |
 | 23 | 0.5.0 |  |  | **Give list pages one view-model helper from query to pagination, instead of ~40 hand-written lines each.** | 3 | 1 | 2 | 4 | 5 | 1 by 4, 9 by 2, code health by 3 | 7.9 |
 | 43 | 0.5.0 |  |  | **Let a plugin version the scripts and other `/public/` files its own markup links, so they are cached as immutable too.** | 2 | 2 | 1 | 3 | 3 | 8 by 3, 7 by 2 | 5.0 |
-| 57 | 0.5.0 |  | owner | **Put the caller's IP, user agent and host on every request's span and `request` log line, under OpenTelemetry's HTTP semantic conventions, reading the IP through a proxy only where configuration names it trusted.** | 2 | 2 | 2 | 4 | 3 | 1 by 3 | 3.3 |
 | 19 | 0.6.0 |  | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
 | 16 | 0.6.0 |  | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
 | 28 | 0.6.0 |  |  | **Let a plugin add entries to the profile menu through the plugin API.** | 2 | 2 | 2 | 4 | 4 | 7 by 4, 1 by 2 | 4.2 |
@@ -67,23 +66,6 @@ favicon and logo, and a plugin's `styles`. A file a plugin's own markup links, s
 the plugin API, hence a minor. Pick one with the plugin authors' panel, then document it in README →
 Reserved view locals.
 
-### 57. Put the caller's IP, user agent and host on every request's span and `request` log line, under OpenTelemetry's HTTP semantic conventions, reading the IP through a proxy only where configuration names it trusted.
-
-Today the `request` line and span in `src/http/app.ts` carry only method, path, status and `ms`, so
-a dashboard can't filter requests by site or tell one caller from another. Add `server.address`
-(the `Host`), `user_agent.original`, `client.address` and `http.route` where a route matched, and
-rename the four fields already there to their convention names (`http.request.method`, `url.path`,
-`http.response.status_code`, and the span's own duration for `ms`). Every plugin gains them with no
-code of its own.
-
-`client.address` is the socket's peer unless a new setting, such as `TRUSTED_PROXIES`, lists that
-peer. Only then does the host take the address `X-Forwarded-For` names (goal 10: an explicit
-choice). Trusting the header from anyone would let a caller write any IP into the logs.
-
-A caller's IP and user agent are personal data, so the README says the host logs them, and a
-deployment's privacy policy must say so too. bender-infra's Requests dashboard (its todo.md item
-117) reads these names, and fastjira (its item 161) is the first plugin to send them.
-
 ### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
 
 Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is