servarr + plex: bump image tags

- sonarr     version-4.0.16.2944 -> version-4.0.17.2952  (patch within 4.0.x)
  - radarr×2   version-6.0.4.10291 -> version-6.1.1.10360  (minor within 6.x)
  - prowlarr   version-2.3.0.5236  -> version-2.3.5.5327   (patch within 2.3.x)
  - plex       1.43.0.10467-...    -> 1.43.2.10687-...     (patch within 1.43.x)

All four were stuck because of tag-format issues that I addressed in
PR #82 (servarr customManager) / PR #83. Renovate isn't auto-creating
the PRs yet (DH rate-limit), so doing them manually so version-checker
clears.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -62,6 +62,27 @@ data:
           "packageNameTemplate": "Termix-SSH/Termix",
           "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
           "extractVersionTemplate": "^(?<version>release-\\d+\\.\\d+\\.\\d+)"
+        },
+        {
+          "description": "linuxserver servarr apps (prowlarr, radarr, sonarr) use tag pattern `version-X.Y.Z.B` (4 segments + `version-` prefix). The kubernetes manager's default docker versioning rejects them at the pre-check (same failure class as termix), so no PRs ever open. Use regex versioning to parse the prefixed 4-segment form; depName is captured from the regex so the same customManager handles all three apps.",
+          "customType": "regex",
+          "managerFilePatterns": ["/servarr-system/.+\\.ya?ml$/"],
+          "matchStrings": [
+            "image:\\s+linuxserver/(?<depName>prowlarr|radarr|sonarr):(?<currentValue>version-\\d+\\.\\d+\\.\\d+\\.\\d+)"
+          ],
+          "datasourceTemplate": "docker",
+          "packageNameTemplate": "linuxserver/{{depName}}",
+          "versioningTemplate": "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$"
+        },
+        {
+          "description": "umami: the docker image tag is `postgresql-vX.Y.Z` (the PostgreSQL-flavored variant). Default docker versioning rejects the prefix. Same fix as termix/servarr: regex versioning parses the prefixed value; ghcr.io tag list is filtered to the postgresql-v* track only.",
+          "customType": "regex",
+          "managerFilePatterns": ["/felhom-system/umami\\.ya?ml$/"],
+          "matchStrings": [
+            "image:\\s+(?<depName>ghcr\\.io/umami-software/umami):(?<currentValue>postgresql-v\\d+\\.\\d+\\.\\d+)"
+          ],
+          "datasourceTemplate": "docker",
+          "versioningTemplate": "regex:^postgresql-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
         }
       ],
       "packageRules": [
@@ -128,6 +149,22 @@ data:
           "matchManagers": ["kubernetes"],
           "matchPackageNames": ["ghcr.io/lukegus/termix"],
           "enabled": false
+        },
+        {
+          "description": "linuxserver servarr apps: same disable pattern as termix. The customManager above handles extraction with the right versioning; turn off the default kubernetes-manager extraction so it doesn't silently skip + clutter the dashboard.",
+          "matchManagers": ["kubernetes"],
+          "matchPackageNames": [
+            "linuxserver/prowlarr",
+            "linuxserver/radarr",
+            "linuxserver/sonarr"
+          ],
+          "enabled": false
+        },
+        {
+          "description": "umami: same disable pattern. customManager handles extraction; kubernetes-manager would silently skip `postgresql-vX.Y.Z`.",
+          "matchManagers": ["kubernetes"],
+          "matchPackageNames": ["ghcr.io/umami-software/umami"],
+          "enabled": false
         }
       ],
       "labels": ["renovate"]
@@ -141,7 +178,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: renovate
     app.kubernetes.io/name: renovate
-    app.kubernetes.io/version: "43.197.0"
+    app.kubernetes.io/version: "43.209.3"
 spec:
   # Sat 02:00 Europe/Budapest — leaves the full weekend for troubleshooting
   # if a Renovate-merged update breaks something.
@@ -156,14 +193,14 @@ spec:
       labels:
         app.kubernetes.io/instance: renovate
         app.kubernetes.io/name: renovate
-        app.kubernetes.io/version: "43.197.0"
+        app.kubernetes.io/version: "43.209.3"
     spec:
       template:
         metadata:
           labels:
             app.kubernetes.io/instance: renovate
             app.kubernetes.io/name: renovate
-            app.kubernetes.io/version: "43.197.0"
+            app.kubernetes.io/version: "43.209.3"
           annotations:
             # Renovate uses plain X.Y.Z semver tags (no -slim suffix anymore)
             match-regex.version-checker.io/renovate: '^\d+\.\d+\.\d+$'

felhom-system/umami.yaml

@@ -187,7 +187,7 @@ spec:
               cpu: "50m"
       containers:
         - name: umami
-          image: ghcr.io/umami-software/umami:postgresql-latest
+          image: ghcr.io/umami-software/umami:postgresql-v1.38.0
           ports:
             - containerPort: 3000
           env:

felhom-system/webpage.yaml

@@ -100,7 +100,7 @@ spec:
     spec:
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2-alpine
+          image: filebrowser/filebrowser:v2.63.13
           ports:
             - containerPort: 8080
           volumeMounts:

helm/pihole/values.yaml

@@ -1,4 +1,11 @@
 ---
+# Image tag override: bumps pihole/pihole to 2026.05.0 without changing
+# the chart version. The 2026.05.0 release bundles FTL v6.6.2 which
+# imports 6 upstream dnsmasq CVE fixes (covering the dnsmasq 2.92/2.93
+# disclosures). No FTL-side config or API changes per the release notes.
+# https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.05.0
+image:
+  tag: "2026.05.0"
 DNS1: "1.1.1.1"   # Cloudflare
 DNS2: "8.8.8.8"   # Google
 DNS3: "9.9.9.9"   #Quad9

helm/plex/values.yaml

@@ -4,7 +4,7 @@ image:
   registry: index.docker.io
   repository: plexinc/pms-docker
   # renovate: datasource=custom.plex depName=plex versioning=loose
-  tag: "1.43.0.10467-2b1ba6e69"
+  tag: "1.43.2.10687-563d026ea"
   sha: ""
   pullPolicy: IfNotPresent
 
@@ -235,7 +235,10 @@ statefulSet:
   annotations: {}
   # -- Optional extra annotations to add to the pods in the statefulset
   podAnnotations: 
-    match-regex.version-checker.io/plex-plex-media-server-pms: ^\d+\.\d+\.\d+\.\d+-.*$
+    # Match only `<X.Y.Z.B>-<short-hash>` (the amd64/native tag form) and exclude
+    # per-arch tags (e.g. `-armhf`, `-arm64`) so version-checker doesn't show an
+    # ARM tag as "newer" than our x86_64 install.
+    match-regex.version-checker.io/plex-plex-media-server-pms: '^\d+\.\d+\.\d+\.\d+-[a-f0-9]+$'
 
 service:
   type: LoadBalancer

nextcloud-system/nextcloud.yaml

@@ -392,10 +392,13 @@ spec:
         nextcloud-config-hash: 06b49913be13b1f9a81745166dd75ada59e7ddd39e8f6a2c5538affe2a6d1093
         php-config-hash: 5a497358af870e06b42325eee83d7c0e5466b7f6819cb49b598559d96def7428
         hooks-hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
+        # Only match the `X.Y.Z-apache` variant tags so version-checker doesn't
+        # treat the bare `X.Y.Z` server tag as a "newer" version of our apache image.
+        match-regex.version-checker.io/nextcloud: '^\d+\.\d+\.\d+-apache$'
     spec:
       containers:
         - name: nextcloud
-          image: docker.io/library/nextcloud:33.0.4-apache
+          image: docker.io/library/nextcloud:33.0.5-apache
           imagePullPolicy: IfNotPresent
           env:
             - name: SMTP_HOST

servarr-system/servarr.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: prowlarr
-          image: linuxserver/prowlarr:version-2.3.0.5236
+          image: linuxserver/prowlarr:version-2.3.5.5327
           imagePullPolicy: IfNotPresent
           env:
             - name: PUID
@@ -91,7 +91,7 @@ spec:
     spec:
       containers:
         - name: radarr
-          image: linuxserver/radarr:version-6.0.4.10291
+          image: linuxserver/radarr:version-6.1.1.10360
           imagePullPolicy: IfNotPresent
           env:
             - name: PUID
@@ -164,7 +164,7 @@ spec:
     spec:
       containers:
         - name: sonarr
-          image: linuxserver/sonarr:version-4.0.16.2944
+          image: linuxserver/sonarr:version-4.0.17.2952
           imagePullPolicy: IfNotPresent
           env:
             - name: PUID
@@ -705,7 +705,7 @@ spec:
     spec:
       containers:
         - name: radarr
-          image: linuxserver/radarr:version-6.0.4.10291
+          image: linuxserver/radarr:version-6.1.1.10360
           imagePullPolicy: IfNotPresent
           env:
             - name: PUID

tandoor-system/tandoor.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       initContainers:
         - name: create-superuser
-          image: vabene1111/recipes:2.6
+          image: vabene1111/recipes:2.6.9
           workingDir: /opt/recipes
           command:
             - /bin/sh
@@ -106,7 +106,7 @@ spec:
                   key: email
       containers:
         - name: tandoor
-          image: vabene1111/recipes:2.6
+          image: vabene1111/recipes:2.6.9
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

termix-system/termix.yaml

@@ -45,7 +45,7 @@ spec:
           # Renovate handles it via a customManagers regex defined in
           # admin-system/renovate.yaml (the kubernetes manager doesn't
           # process inline `# renovate:` comments).
-          image: ghcr.io/lukegus/termix:release-1.11.2
+          image: ghcr.io/lukegus/termix:release-2.3.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: http