pihole: bump image to 2026.05.0 (dnsmasq CVE security release)

Pi-hole 2026.05.0 bundles FTL v6.6.2 which imports six upstream dnsmasq
security fixes, covering all publicly disclosed CVEs against the
dnsmasq 2.92/2.93 line. Per the upstream release notes the fixes are
"minimal, self-contained changes to the embedded dnsmasq sources. No
FTL-side configuration or API changes; users should see no observable
behavior change beyond the closed vulnerabilities."

Override the chart's default image.tag in helm/pihole/values.yaml (no
chart version bump). The pihole ArgoCD app is intentionally MANUAL
sync per Viktor's call -- after merge, sync the pihole app from the
ArgoCD UI to roll the pod over.

https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.05.0

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -114,6 +114,15 @@ data:
           "matchPackageNames": ["getmeili/meilisearch"],
           "dependencyDashboardApproval": true
         },
+        {
+          "description": "Postgres-family images: a major bump (e.g. 16 -> 17) requires pg_upgrade or dump/restore — the new server binary refuses to open the old data directory (`database files are incompatible with server`). PR #76 (immich-app/postgres 16 -> 17) on 2026-06-06 crashlooped immich-postgres and immich-server. Renovate's docker versioning treats these custom tag formats inconsistently, so don't trust the major/minor classification: hold ALL updates for these images behind explicit dashboard approval. Includes vanilla postgres, postgis/postgis (where the tag prefix IS the pg major), and ghcr.io/immich-app/postgres (custom `N-vectorchordX.Y.Z` form).",
+          "matchPackageNames": [
+            "postgres",
+            "postgis/postgis",
+            "ghcr.io/immich-app/postgres"
+          ],
+          "dependencyDashboardApproval": true
+        },
         {
           "description": "termix: kubernetes manager would extract the image with versioning=docker and silently skip it (release-1.11.0 fails the docker pre-check). Disable that extraction; customManagers above does the real work via github-releases.",
           "matchManagers": ["kubernetes"],

arcade-system/romm.yaml

@@ -56,7 +56,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7.4-alpine
+          image: redis:8.8-alpine
           ports:
             - containerPort: 6379
               name: redis

booking-system/booking.yaml

@@ -77,7 +77,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:8-alpine
           imagePullPolicy: IfNotPresent
           args:
             - redis-server

database-system/cnpg/values.yaml

@@ -57,7 +57,7 @@ replicaCount: 1
 # Image configuration (optional - use defaults)
 image:
   repository: ghcr.io/cloudnative-pg/cloudnative-pg
-  tag: 1.28.1
+  tag: 1.29.1
 
 # Service configuration
 service:

helm/pihole/values.yaml

@@ -1,4 +1,11 @@
 ---
+# Image tag override: bumps pihole/pihole to 2026.05.0 without changing
+# the chart version. The 2026.05.0 release bundles FTL v6.6.2 which
+# imports 6 upstream dnsmasq CVE fixes (covering the dnsmasq 2.92/2.93
+# disclosures). No FTL-side config or API changes per the release notes.
+# https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.05.0
+image:
+  tag: "2026.05.0"
 DNS1: "1.1.1.1"   # Cloudflare
 DNS2: "8.8.8.8"   # Google
 DNS3: "9.9.9.9"   #Quad9

immich-system/immich.yaml

@@ -336,7 +336,7 @@ spec:
               value: http://immich-machine-learning:3003
             - name: REDIS_HOSTNAME
               value: immich-valkey
-          image: ghcr.io/immich-app/immich-server:v2.5.5
+          image: ghcr.io/immich-app/immich-server:v2.7.5
           imagePullPolicy: IfNotPresent
           livenessProbe:
             failureThreshold: 3

jarrs-system/jarr-dev.yaml

@@ -185,7 +185,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:8-alpine
           imagePullPolicy: IfNotPresent
           args:
             - redis-server

mon-system/monitoring.yaml

@@ -529,7 +529,7 @@ spec:
         runAsGroup: 472
       containers:
         - name: grafana
-          image: grafana/grafana:12.4.4
+          image: grafana/grafana:13.0.2
           ports:
             - containerPort: 3000
               name: http

nextcloud-system/nextcloud.yaml

@@ -395,7 +395,7 @@ spec:
     spec:
       containers:
         - name: nextcloud
-          image: docker.io/library/nextcloud:33.0.4-apache
+          image: docker.io/library/nextcloud:33.0.5-apache
           imagePullPolicy: IfNotPresent
           env:
             - name: SMTP_HOST

outline-system/outline.yaml

@@ -198,7 +198,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:8-alpine
           imagePullPolicy: IfNotPresent
           command:
             - redis-server

paperless-system/paperless.yaml

@@ -71,7 +71,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:8-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - name: redis

plantit-system/plantit.yaml

@@ -121,7 +121,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7.4.9
+          image: redis:8.8.0
           ports:
             - containerPort: 6379
               name: redis

termix-system/termix.yaml

@@ -45,7 +45,7 @@ spec:
           # Renovate handles it via a customManagers regex defined in
           # admin-system/renovate.yaml (the kubernetes manager doesn't
           # process inline `# renovate:` comments).
-          image: ghcr.io/lukegus/termix:release-1.11.2
+          image: ghcr.io/lukegus/termix:release-2.3.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: http