chore(deps): update renovate/renovate docker tag to v43.209.1

.woodpecker/renovate.yaml

@@ -46,7 +46,7 @@ steps:
       - bao kv get -mount secret -field GITHUB_COM_TOKEN renovate > /woodpecker/github_com_token
   - name: renovate
     # Renovate's built-in "woodpecker" manager tracks this image automatically.
-    image: renovate/renovate:43.207.4
+    image: renovate/renovate:43.209.1
     environment:
       # --- platform / target ---
       RENOVATE_PLATFORM: gitea

Dockerfile

@@ -21,8 +21,8 @@
 # =============================================================================
 FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS builder
 
-# renovate: datasource=github-releases depName=tailscale packageName=tailscale/tailscale versioning=semver
+# renovate: datasource=github-releases depName=tailscale packageName=tailscale/tailscale
-ARG TAILSCALE_VERSION=v1.98.5
+ARG TAILSCALE_VERSION=v1.98.3
 
 # Provided automatically by buildx for the target platform.
 ARG TARGETOS
@@ -199,7 +199,7 @@ RUN printf '%s\n' \
 FROM alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS busybox
 
 # renovate: datasource=docker depName=busybox versioning=docker
-ARG BUSYBOX_VERSION=1.38.0
+ARG BUSYBOX_VERSION=1.37.0
 
 RUN apk add --no-cache build-base linux-headers wget bzip2 perl upx
 

renovate.json

@@ -27,8 +27,9 @@
     {
       "matchDatasources": ["github-releases"],
       "matchPackageNames": ["tailscale/tailscale"],
-      "description": "TAILSCALE_VERSION ARG: only stable releases. Tailscale uses EVEN minor versions for stable (v1.98.x); ODD minors (v1.99.x) are unstable, so filter to even minors and ignore pre-releases. The `v` prefix is kept (no extractVersion) so the ARG value stays v-prefixed to match the git tags cloned in the Dockerfile.",
+      "description": "TAILSCALE_VERSION ARG: only stable releases. Tailscale uses EVEN minor versions for stable (v1.98.x); ODD minors (v1.99.x) are unstable, so filter to even minors and ignore pre-releases.",
-      "allowedVersions": "/^v\\d+\\.\\d*[02468]\\.\\d+$/",
+      "extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
+      "allowedVersions": "/^\\d+\\.\\d*[02468]\\.\\d+$/",
       "ignoreUnstable": true
     },
     {