[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@​artmizu/nuxt-prometheus	3.0.4 → 3.0.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 1 to add, 1 to change, 1 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.service.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
      ~ health_check_grace_period_seconds  = 0 -> 120
        id                                 = "arn:aws:ecs:eu-central-1:553637109631:service/javabin-platform/cupcake-cupcake"
        name                               = "cupcake-cupcake"
      ~ tags                               = {
          + "javabin:desired-count" = "1"
        }
      ~ tags_all                           = {
          + "javabin:desired-count" = "1"
            # (5 unchanged elements hidden)
        }
        # (15 unchanged attributes hidden)

        # (5 unchanged blocks hidden)
    }

  # module.service.aws_ecs_task_definition.this must be replaced
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:4" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  + dependsOn              = [
                      + {
                          + condition     = "SUCCESS"
                          + containerName = "platform_tmp_init"
                        },
                    ]
                    name                   = "cupcake"
                  ~ portMappings           = [
                      ~ {
                          - hostPort      = 3000
                            # (2 unchanged attributes hidden)
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (8 unchanged attributes hidden)
                },
              + {
                  + command                = [
                      + "chmod",
                      + "1777",
                      + "/tmp",
                    ]
                  + essential              = false
                  + image                  = "public.ecr.aws/docker/library/busybox@sha256:a7dbc319b1438115a207e11930dc4bb3e643dcb3ec0bdd694bb36cd8fad289ec"
                  + logConfiguration       = {
                      + logDriver = "awslogs"
                      + options   = {
                          + awslogs-group         = "/ecs/cupcake/cupcake"
                          + awslogs-region        = "eu-central-1"
                          + awslogs-stream-prefix = "cupcake"
                        }
                    }
                  + mountPoints            = [
                      + {
                          + containerPath = "/tmp"
                          + readOnly      = false
                          + sourceVolume  = "tmp"
                        },
                    ]
                  + name                   = "platform_tmp_init"
                  + readonlyRootFilesystem = true
                  + user                   = "0"
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "cupcake-cupcake" -> (known after apply)
      ~ revision                 = 4 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

      - volume {
          - configure_at_launch = false -> null
          - name                = "tmp" -> null
        }
      + volume {
          + configure_at_launch = (known after apply)
          + name                = "tmp"
        }
    }

Plan: 1 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan updates the cupcake ECS service in place (health check grace period and a tag) and replaces its task definition to add a temporary busybox init container that sets /tmp permissions, with no security group, IAM, or public exposure changes and no new billable resources.

• 💥 [destruction] aws_ecs_task_definition.this is destroyed and recreated (forced by container_definitions change). This is a new revision, not data loss; the old revision remains registered in ECS. The ECS service will roll to the new revision on apply, which is a normal rolling deployment.
• ✅ [routine] New init container 'platform_tmp_init' (busybox, pinned by digest) runs 'chmod 1777 /tmp' as root (user 0) with readonlyRootFilesystem=true, is non-essential, and the main container 'cupcake' gets dependsOn SUCCESS on it. Shared 'tmp' volume is added. Purpose is to make /tmp writable under a read-only root filesystem; this is a reasonable hardening pattern.
• ✅ [routine] Main container 'cupcake' loses its hostPort 3000 mapping (the portMappings hostPort is removed). Under awsvpc networking, hostPort is typically redundant with containerPort, but confirm the service's network mode and any load balancer target configuration still work as expected.
• ✅ [routine] ECS service health_check_grace_period_seconds changes from 0 to 120, giving tasks 120 seconds before load balancer health checks count against them. Low risk; tag 'javabin:desired-count = 1' added to service tags.
• 💰 [cost] No new billable resources (no NAT gateways, load balancers, RDS, or added Fargate capacity beyond the normal task replacement). The init container is short-lived.
• 🔒 [security] No security group, IAM role/policy, or public network changes in this plan.

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.