chore(deps): update docker.io/pihole/pihole docker tag to v2026.09.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/pihole/pihole	Kustomization	minor	2026.07.2 → 2026.09.0

---

Release Notes

pi-hole/docker-pi-hole (docker.io/pihole/pihole)

v2026.09.0

Compare Source

Whats Changed? (Docker)

Nothing Docker specific, tagging to include FTL v6.7.1

Full Changelog: pi-hole/docker-pi-hole@2026.07.1...2026.09.0

Whats Changed? (FTL v6.7.1)

Security Fixes

• pi-hole/FTL/security/advisories/GHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via webserver.advancedOpts (High) reported by keithlinneman
• pi-hole/FTL/security/advisories/GHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in misc.dnsmasq_lines (High) reported by keithlinneman
• pi-hole/FTL/security/advisories/GHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)
• pi-hole/FTL/security/advisories/GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110

Behavior changes

• misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.
• Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.
• The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.
• database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.

Fixes of note

• pi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#​3050)
• An infinite loop in the dnsmasq config test when debug.config is enabled
• Webserver workers spinning at 100% CPU in the mbedTLS debug callback (#​3106)
• Async-signal-safety in the real-time signal handler and the TCP worker terminator
• Query indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committed
• Database connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctness
• Memory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan

Full Changelog: pi-hole/FTL@v6.7...v6.7.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.