Update ghcr.io/immich-app/immich-server Docker tag to v2.7.5

Verified with the GitHub Releases API for Termix-SSH/Termix that the
actual `tag_name` field is `release-X.Y.Z-tag` (with a `-tag` suffix),
even though the release `name` is `release-X.Y.Z`. Renovate's
github-releases datasource keys off `tag_name`, so the regex versioning
correctly rejects all candidates as invalid:

  INFO: Found no results from datasource that look like a version
        (dependency=Termix-SSH/Termix)

The docker image at ghcr.io/lukegus/termix uses the short form
(`release-X.Y.Z`, no suffix), which is what the manifest also has.

Fix: add `extractVersionTemplate: ^(?<version>release-\d+\.\d+\.\d+)`
which Renovate applies to each candidate from the datasource BEFORE
the versioning regex sees it. tag_names `release-2.3.2-tag` become
`release-2.3.2`, the regex versioning parses them, comparison works,
and Renovate writes the short form back to the manifest -- which is
the correct tag at the ghcr.io registry.

(extractVersion is NOT applied to currentValue, but currentValue already
is in the short form, so no normalization needed there.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -52,7 +52,7 @@ data:
       },
       "customManagers": [
         {
-          "description": "termix uses a release-X.Y.Z prefixed tag. extractVersion + loose doesn't work because Renovate validates the raw currentValue BEFORE applying extractVersion. Using regex versioning (which parses the prefixed value directly) sidesteps the pre-check. Datasource redirected to GitHub Releases at Termix-SSH/Termix so the 3-day stability gate has real timestamps to work with.",
+          "description": "termix: docker image tag is `release-X.Y.Z` but the upstream GitHub release tag_name is `release-X.Y.Z-tag` (different from the release name). regex versioning parses currentValue (no -tag); extractVersion strips the -tag suffix from candidate tag_names so they normalize to the same shape Renovate writes back to the manifest.",
           "customType": "regex",
           "managerFilePatterns": ["/termix-system/.+\\.ya?ml$/"],
           "matchStrings": [
@@ -60,7 +60,8 @@ data:
           ],
           "datasourceTemplate": "github-releases",
           "packageNameTemplate": "Termix-SSH/Termix",
-          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+          "extractVersionTemplate": "^(?<version>release-\\d+\\.\\d+\\.\\d+)"
         }
       ],
       "packageRules": [

bookstack-system/bookstack.yaml

@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
         - name: bookstack
-          image: linuxserver/bookstack:25.12.20251224
+          image: linuxserver/bookstack:26.05.20260601
           imagePullPolicy: IfNotPresent
           env:
             # LinuxServer.io specific

gitea-system/gitea.yaml

@@ -44,7 +44,7 @@ spec:
               mountPath: /data
       containers:
         - name: gitea
-          image: gitea/gitea:1.25.4
+          image: gitea/gitea:1.26.2
           imagePullPolicy: IfNotPresent
           env:
             - name: USER_UID

glance-system/glance-helper.yaml

@@ -1384,7 +1384,7 @@ spec:
         # Calendar iCal URLs (JSON object: {"name": "url", ...})
         - name: CALENDAR_ICAL_URLS
           value: '{"Órák": "https://calendar.google.com/calendar/ical/b2884faf3db792ac082a6206057552c79080716efd5f966e169a41fc500e1c1c%40group.calendar.google.com/private-0998d8053909ba4449c2f0a6409ce3de/basic.ics", "Családi": "https://calendar.google.com/calendar/ical/nitq3l0if4gn54k438obat5ia0%40group.calendar.google.com/private-59afcf70fee1a798ec369b86d9883b46/basic.ics"}'
-        image: python:3.12-bookworm
+        image: python:3.14-bookworm
         imagePullPolicy: IfNotPresent
         name: glance-helper
         ports:

immich-system/immich.yaml

@@ -336,7 +336,7 @@ spec:
               value: http://immich-machine-learning:3003
             - name: REDIS_HOSTNAME
               value: immich-valkey
-          image: ghcr.io/immich-app/immich-server:v2.5.5
+          image: ghcr.io/immich-app/immich-server:v2.7.5
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 3

kisfenyo-system/filebrowser-quantum.yaml

@@ -136,7 +136,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: filebrowser
-          image: gtstef/filebrowser:1.1.2-stable
+          image: gtstef/filebrowser:1.3.3-stable
           env:
             - name: TZ
               value: "Europe/Budapest"

nextcloud-system/nextcloud.yaml

@@ -395,7 +395,7 @@ spec:
     spec:
       containers:
         - name: nextcloud
-          image: docker.io/library/nextcloud:32.0.10-apache
+          image: docker.io/library/nextcloud:33.0.4-apache
           imagePullPolicy: IfNotPresent
           env:
             - name: SMTP_HOST

plantit-system/plantit.yaml

@@ -43,7 +43,7 @@ spec:
     spec:
       containers:
         - name: mysql
-          image: mysql:8.0
+          image: mysql:8.4
           env:
             - name: MYSQL_ROOT_PASSWORD
               valueFrom: