Merge pull request 'chore(deps): Update lscr.io/linuxserver/jackett Docker tag to v0.24.3053-ls34' (#170) from renovate/lscr.io-linuxserver-jackett-0.x into main

Reviewed-on: #163
Reviewed-by: Keith Jackson <[email protected]>

.gitea/workflows/renovate.yaml

@@ -151,7 +151,7 @@ jobs:
     # actions/checkout: Renovate clones the repo itself from RENOVATE_ENDPOINT, and as uid 12021
     # checkout could not `git init` the root-owned workspace volume anyway.
     container:
-      image: ghcr.io/renovatebot/renovate:44.167.0
+      image: ghcr.io/renovatebot/renovate:44.227.4
     # Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
     # well under a runner's patience. Without a timeout a wedged run holds the `renovate`
     # concurrency group and silently blocks every subsequent scheduled run.

apps/wave-0/jackett.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: jackett
-        image: lscr.io/linuxserver/jackett:v0.24.3030-ls30
+        image: lscr.io/linuxserver/jackett:v0.24.3053-ls34
         ports:
         - containerPort: 9117
         volumeMounts:

apps/wave-1/semaphore.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: semaphore
-        image: semaphoreui/semaphore:v2.19.17
+        image: semaphoreui/semaphore:v2.20.23
         ports:
         - containerPort: 3000
         env:

catalog/jackett.yaml

@@ -16,7 +16,7 @@
 name: jackett
 kind: container
 source:
-  image: lscr.io/linuxserver/jackett:v0.24.3030-ls30
+  image: lscr.io/linuxserver/jackett:v0.24.3053-ls34
 exposure: internal              # LAN-only web UI at jackett.${BASE_DOMAIN} (docs/13 row 4; R-DNS/R-NET)
 egress: vpn                     # indexer scraping via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
 storage:

catalog/semaphore.yaml

@@ -22,7 +22,7 @@
 name: semaphore
 kind: container
 source:
-  image: semaphoreui/semaphore:v2.19.17   # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: semaphoreui/semaphore:v2.20.23   # pinned recent stable tag (R-UPD-01); update.range governs advancement
 env:
   # --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
   #     sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,

infra/agent/versions.env

@@ -18,7 +18,7 @@
 # digest. For a LOCAL build on a local toolbox, override it:
 #   infra/devcontainer/dev.sh build && AGENT_BASE_IMAGE=home-k3s-dev:local infra/agent/build-image.sh
 # renovate-digest: image=gitea.home.keithjackson.dev/home-network/toolbox tag=main
-AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:d435fabd6fc43bf5bb4de0c1ea8c4b19d8cea5c858679bd1675ccbed471b528a
+AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:83a3501efe34fa0b039e3f0d360738686a0f59109866c49779768f5d5ed0ef81
 
 # Node.js — the runtime for the Claude Code CLI, installed from the Fedora base's module
 # stream. A major version, not a patch: the CLI supports the active LTS line and the

platform/keycloak/passkey-reconciler.yaml

@@ -3205,7 +3205,7 @@ spec:
               # sibling's pod on prod runs a different digest under this same tag.
               # Renovate's `kubernetes` manager covers platform/** (renovate.json5), so
               # it proposes tag and digest bumps for this line like any other image.
-              image: python:3.15.2-alpine3.23@sha256:8d77d813a53e534dec9e1e5182cbd5b651b70d63b27e4ea7c1f616b37cf9aad2
+              image: python:3.15.2-alpine3.23@sha256:32f06114a111c2467804d06194c5584f16804a78cfaf427fb1fcbb0b3391d0f1
               imagePullPolicy: IfNotPresent
               command:
                 - python3