Update ghcr.io/immich-app/postgres Docker tag to v17

Verified with the GitHub Releases API for Termix-SSH/Termix that the
actual `tag_name` field is `release-X.Y.Z-tag` (with a `-tag` suffix),
even though the release `name` is `release-X.Y.Z`. Renovate's
github-releases datasource keys off `tag_name`, so the regex versioning
correctly rejects all candidates as invalid:

  INFO: Found no results from datasource that look like a version
        (dependency=Termix-SSH/Termix)

The docker image at ghcr.io/lukegus/termix uses the short form
(`release-X.Y.Z`, no suffix), which is what the manifest also has.

Fix: add `extractVersionTemplate: ^(?<version>release-\d+\.\d+\.\d+)`
which Renovate applies to each candidate from the datasource BEFORE
the versioning regex sees it. tag_names `release-2.3.2-tag` become
`release-2.3.2`, the regex versioning parses them, comparison works,
and Renovate writes the short form back to the manifest -- which is
the correct tag at the ghcr.io registry.

(extractVersion is NOT applied to currentValue, but currentValue already
is in the short form, so no normalization needed there.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -52,7 +52,7 @@ data:
       },
       "customManagers": [
         {
-          "description": "termix uses a release-X.Y.Z prefixed tag that the kubernetes manager's docker-versioning pre-check rejects (so no PRs are ever created). This customManager extracts the image directly, redirects the version lookup to GitHub Releases at Termix-SSH/Termix (which exposes timestamps the 3-day stability gate needs), and uses extractVersion to strip the `release-` prefix so loose semver can parse it.",
+          "description": "termix: docker image tag is `release-X.Y.Z` but the upstream GitHub release tag_name is `release-X.Y.Z-tag` (different from the release name). regex versioning parses currentValue (no -tag); extractVersion strips the -tag suffix from candidate tag_names so they normalize to the same shape Renovate writes back to the manifest.",
           "customType": "regex",
           "managerFilePatterns": ["/termix-system/.+\\.ya?ml$/"],
           "matchStrings": [
@@ -60,8 +60,8 @@ data:
           ],
           "datasourceTemplate": "github-releases",
           "packageNameTemplate": "Termix-SSH/Termix",
-          "versioningTemplate": "loose",
+          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
-          "extractVersionTemplate": "^release-(?<version>.+)$"
+          "extractVersionTemplate": "^(?<version>release-\\d+\\.\\d+\\.\\d+)"
         }
       ],
       "packageRules": [
@@ -158,7 +158,7 @@ spec:
           restartPolicy: OnFailure
           containers:
             - name: renovate
-              image: renovate/renovate:43.197.0
+              image: renovate/renovate:43.209.3
               imagePullPolicy: IfNotPresent
               envFrom:
                 - secretRef:

admin-system/tailscale.yaml

@@ -90,7 +90,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: tailscale
-          image: tailscale/tailscale:v1.94.1
+          image: tailscale/tailscale:v1.98.4
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

arcade-system/romm.yaml

@@ -388,7 +388,7 @@ spec:
     spec:
       containers:
         - name: mariadb
-          image: mariadb:12
+          image: mariadb:11
           env:
             - name: MARIADB_ROOT_PASSWORD
               valueFrom:

bookstack-system/bookstack.yaml

@@ -71,7 +71,7 @@ spec:
     spec:
       containers:
         - name: mariadb
-          image: mariadb:12
+          image: mariadb:11
           imagePullPolicy: IfNotPresent
           env:
             - name: MYSQL_ROOT_PASSWORD
@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
         - name: bookstack
-          image: linuxserver/bookstack:25.12.20251224
+          image: linuxserver/bookstack:26.05.20260601
           imagePullPolicy: IfNotPresent
           env:
             # LinuxServer.io specific

gitea-system/gitea.yaml

@@ -44,7 +44,7 @@ spec:
               mountPath: /data
       containers:
         - name: gitea
-          image: gitea/gitea:1.25.4
+          image: gitea/gitea:1.26.2
           imagePullPolicy: IfNotPresent
           env:
             - name: USER_UID

glance-system/glance-helper.yaml

@@ -1384,7 +1384,7 @@ spec:
         # Calendar iCal URLs (JSON object: {"name": "url", ...})
         - name: CALENDAR_ICAL_URLS
           value: '{"Órák": "https://calendar.google.com/calendar/ical/b2884faf3db792ac082a6206057552c79080716efd5f966e169a41fc500e1c1c%40group.calendar.google.com/private-0998d8053909ba4449c2f0a6409ce3de/basic.ics", "Családi": "https://calendar.google.com/calendar/ical/nitq3l0if4gn54k438obat5ia0%40group.calendar.google.com/private-59afcf70fee1a798ec369b86d9883b46/basic.ics"}'
-        image: python:3.12-bookworm
+        image: python:3.14-bookworm
         imagePullPolicy: IfNotPresent
         name: glance-helper
         ports:

helm/plex/values.yaml

@@ -181,7 +181,7 @@ rclone:
     registry: index.docker.io
     repository: rclone/rclone
     # -- If unset use latest
-    tag: 1.74.2
+    tag: 1.74.3
     sha: ""
     pullPolicy: IfNotPresent
 

immich-system/immich.yaml

@@ -45,7 +45,7 @@ spec:
         fsGroup: 999
       containers:
         - name: postgres
-          image: ghcr.io/immich-app/postgres:16-vectorchord0.3.0
+          image: ghcr.io/immich-app/postgres:17-vectorchord0.3.0
           env:
             - name: POSTGRES_USER
               valueFrom:

kisfenyo-system/filebrowser-quantum.yaml

@@ -136,7 +136,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: filebrowser
-          image: gtstef/filebrowser:1.1.2-stable
+          image: gtstef/filebrowser:1.3.3-stable
           env:
             - name: TZ
               value: "Europe/Budapest"

nextcloud-system/nextcloud.yaml

@@ -395,7 +395,7 @@ spec:
     spec:
       containers:
         - name: nextcloud
-          image: docker.io/library/nextcloud:32.0.10-apache
+          image: docker.io/library/nextcloud:33.0.4-apache
           imagePullPolicy: IfNotPresent
           env:
             - name: SMTP_HOST

orsi-system/filebrowser.yaml

@@ -89,7 +89,7 @@ spec:
       initContainers:
         # Configure proxy auth in database before starting
         - name: configure-auth
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - sh
             - -c
@@ -109,7 +109,7 @@ spec:
             runAsGroup: 1001
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - filebrowser
             - --database=/config/filebrowser.db

plantit-system/plantit.yaml

@@ -43,7 +43,7 @@ spec:
     spec:
       containers:
         - name: mysql
-          image: mysql:8.0
+          image: mysql:8.4
           env:
             - name: MYSQL_ROOT_PASSWORD
               valueFrom:

tandoor-system/tandoor.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       initContainers:
         - name: create-superuser
-          image: vabene1111/recipes:2.5
+          image: vabene1111/recipes:2.6
           workingDir: /opt/recipes
           command:
             - /bin/sh
@@ -106,7 +106,7 @@ spec:
                   key: email
       containers:
         - name: tandoor
-          image: vabene1111/recipes:2.5
+          image: vabene1111/recipes:2.6
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

vaultwarden-system/vaultwarden.yaml

@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:1.35.2
+          image: vaultwarden/server:1.36.0
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

web-system/web.yaml

@@ -130,7 +130,7 @@ spec:
       initContainers:
         # Configure proxy auth in database before starting
         - name: configure-auth
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - sh
             - -c
@@ -151,7 +151,7 @@ spec:
             runAsGroup: 1000
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - filebrowser
             - --database=/config/filebrowser.db