Merge pull request 'chore(deps): Update python Docker tag to v3.15.2' (#135) from renovate/python-3.x into main

Reviewed-on: #135

apps/wave-0/gitea.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.3
+        image: gitea/gitea:1.27.3
         ports:
         - containerPort: 3000
         env:

apps/wave-0/jackett.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: jackett
-        image: lscr.io/linuxserver/jackett:v0.24.3009-ls26
+        image: lscr.io/linuxserver/jackett:v0.24.3025-ls29
         ports:
         - containerPort: 9117
         volumeMounts:

apps/wave-0/qbittorrent.yaml

@@ -122,7 +122,7 @@ spec:
     spec:
       containers:
       - name: qbittorrent
-        image: lscr.io/linuxserver/qbittorrent:5.1.2
+        image: lscr.io/linuxserver/qbittorrent:5.3.0
         ports:
         - containerPort: 8080
         env:

apps/wave-1/gitea-actions.yaml

@@ -167,7 +167,7 @@ spec:
       containers:
         # ---- act_runner: registers with Gitea, dispatches jobs to the DinD daemon ----
         - name: runner
-          image: gitea/act_runner:0.2.11
+          image: gitea/act_runner:0.6.1
           # No `command:` override. The image's own entrypoint (/sbin/tini -- /opt/act/run.sh)
           # registers from env on first boot and runs `act_runner daemon`. The two wait-loops
           # that used to live here are gone: kubelet now holds this container until the dind

apps/wave-1/radarr.yaml

@@ -122,7 +122,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: lscr.io/linuxserver/radarr:5.21.1
+        image: lscr.io/linuxserver/radarr:5.28.0
         ports:
         - containerPort: 7878
         env:

apps/wave-1/semaphore.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: semaphore
-        image: semaphoreui/semaphore:v2.19.10
+        image: semaphoreui/semaphore:v2.19.17
         ports:
         - containerPort: 3000
         env:

apps/wave-2/seerr.yaml

@@ -75,7 +75,7 @@ spec:
     spec:
       containers:
       - name: seerr
-        image: ghcr.io/seerr-team/seerr:v3.4.1
+        image: ghcr.io/seerr-team/seerr:v3.5.1
         ports:
         - containerPort: 5055
         volumeMounts:

catalog/gitea.yaml

@@ -10,7 +10,7 @@
 name: gitea
 kind: container
 source:
-  image: gitea/gitea:1.24.3     # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: gitea/gitea:1.27.3     # pinned recent stable tag (R-UPD-01); update.range governs advancement
 # Headless-install bootstrap (formerly apps/gitea-bootstrap-patch.yaml; now first-class via the
 # ServiceDefinition env/envFrom/lifecycle fields, schema >=1.2.0). Gitea must come up INSTALLED
 # without the interactive web wizard and with a FIXED, persistent SECRET_KEY, so all of this is

catalog/jackett.yaml

@@ -16,7 +16,7 @@
 name: jackett
 kind: container
 source:
-  image: lscr.io/linuxserver/jackett:v0.24.3009-ls26
+  image: lscr.io/linuxserver/jackett:v0.24.3025-ls29
 exposure: internal              # LAN-only web UI at jackett.${BASE_DOMAIN} (docs/13 row 4; R-DNS/R-NET)
 egress: vpn                     # indexer scraping via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
 storage:

catalog/qbittorrent.yaml

@@ -30,7 +30,7 @@
 name: qbittorrent
 kind: container
 source:
-  image: lscr.io/linuxserver/qbittorrent:5.1.2   # pinned stable tag (R-UPD-01); update.range governs advancement
+  image: lscr.io/linuxserver/qbittorrent:5.3.0   # pinned stable tag (R-UPD-01); update.range governs advancement
 # LinuxServer images run their service as the user `abc`, whose uid/gid these two set. They are
 # LOAD-BEARING FOR THE BULK MOUNT, not cosmetic — exactly as on sonarr/radarr. Measured on prod
 # 2026-09-12 BEFORE this change: `id` inside the container reported the qbittorrent-nox process as

catalog/radarr.yaml

@@ -8,7 +8,7 @@
 name: radarr
 kind: container
 source:
-  image: lscr.io/linuxserver/radarr:5.21.1   # pinned stable v5 tag (R-UPD-01); update.range governs advancement
+  image: lscr.io/linuxserver/radarr:5.28.0   # pinned stable v5 tag (R-UPD-01); update.range governs advancement
 # LinuxServer images run their service as the user `abc`, whose uid/gid these two set. They are
 # LOAD-BEARING for the bulk mount, not cosmetic: see the storage note below. The default is 911,
 # which cannot write a 1000:3000-owned 0755 tree.

catalog/seerr.yaml

@@ -24,7 +24,7 @@
 name: seerr
 kind: container
 source:
-  image: ghcr.io/seerr-team/seerr:v3.4.1   # Seerr: maintained Overseerr/Jellyseerr successor, Plex-native request UI (docs/13 row 5); served on 5055
+  image: ghcr.io/seerr-team/seerr:v3.5.1   # Seerr: maintained Overseerr/Jellyseerr successor, Plex-native request UI (docs/13 row 5); served on 5055
 # The ghcr.io/seerr-team/seerr image runs as the non-root user `node:node` (UID 1000 / GID 1000 —
 # the standard node base-image user; confirmed from the image config's User field). On boot the app
 # creates /app/config/logs and writes its settings/DB under the mounted /app/config PVC. A fresh

catalog/semaphore.yaml

@@ -22,7 +22,7 @@
 name: semaphore
 kind: container
 source:
-  image: semaphoreui/semaphore:v2.19.10   # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: semaphoreui/semaphore:v2.19.17   # pinned recent stable tag (R-UPD-01); update.range governs advancement
 env:
   # --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
   #     sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,

platform/crafty/deployment.yaml

@@ -61,7 +61,7 @@ spec:
         - name: crafty
           # registry.gitlab.com/crafty-controller/crafty-4 — official image. Pinned to the current
           # stable release (4.10.8, 2026-07-29; tags are bare semver, NO `v` prefix). Renovate maintains.
-          image: registry.gitlab.com/crafty-controller/crafty-4:4.10.8
+          image: registry.gitlab.com/crafty-controller/crafty-4:4.11.0
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

platform/external-snapshotter/kustomization.yaml

@@ -51,4 +51,4 @@ images:
   # Controller image == CRD version. A version bump = re-vendor crds.yaml + snapshot-controller.yaml
   # at the new tag (see header) AND bump this newTag.
   - name: registry.k8s.io/sig-storage/snapshot-controller
-    newTag: v8.2.0
+    newTag: v8.7.0

platform/external-snapshotter/snapshot-controller.yaml

@@ -194,7 +194,7 @@ spec:
       - args:
         - --v=5
         - --leader-election=true
-        image: registry.k8s.io/sig-storage/snapshot-controller:v8.0.1
+        image: registry.k8s.io/sig-storage/snapshot-controller:v8.7.0
         imagePullPolicy: IfNotPresent
         name: snapshot-controller
       serviceAccountName: snapshot-controller

platform/externaldns/ddns.yaml

@@ -51,7 +51,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cloudflare-ddns
-          image: favonia/cloudflare-ddns:1.17.1
+          image: favonia/cloudflare-ddns:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: CLOUDFLARE_API_TOKEN

platform/homepage/deployment.yaml

@@ -38,7 +38,7 @@ spec:
       containers:
         - name: homepage
           # Renovate maintains this pin (ghcr.io/gethomepage/homepage). Config lives in /app/config.
-          image: ghcr.io/gethomepage/homepage:v2.1.2
+          image: ghcr.io/gethomepage/homepage:v2.7.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

platform/keycloak/client-secret-reconciler.yaml

@@ -1224,7 +1224,7 @@ spec:
               # curlimages elsewhere in the repo. Renovate does not manage plain
               # `image:` tags (renovate.json disables image-tag updates so it never
               # fights Flux image-automation), so this is bumped by hand.
-              image: python:3.13.15-alpine3.23
+              image: python:3.15.2-alpine3.23
               imagePullPolicy: IfNotPresent
               command:
                 - python3

platform/keycloak/passkey-reconciler.yaml

@@ -3205,7 +3205,7 @@ spec:
               # sibling's pod on prod runs a different digest under this same tag.
               # Renovate's `kubernetes` manager covers platform/** (renovate.json5), so
               # it proposes tag and digest bumps for this line like any other image.
-              image: python:3.13.15-alpine3.23@sha256:6438599575cca0d1df94aeee0d2ae088d4d8846eab554b2ee7784a3a6df0d516
+              image: python:3.15.2-alpine3.23@sha256:8d77d813a53e534dec9e1e5182cbd5b651b70d63b27e4ea7c1f616b37cf9aad2
               imagePullPolicy: IfNotPresent
               command:
                 - python3

platform/oauth2-proxy/helmrelease.yaml

@@ -95,7 +95,7 @@ spec:
     # OIDC bootstrap hooks. (ci: flux-postbuild-substitution enforces it.)
     extraInitContainers:
       - name: wait-for-idp
-        image: docker.io/library/alpine:3.22
+        image: docker.io/library/alpine:3.24
         imagePullPolicy: IfNotPresent
         command: ["/bin/sh", "-c"]
         args:

platform/velero/helmrelease.yaml

@@ -88,7 +88,7 @@ spec:
     # rather than becoming a fifth per-environment knob. ---
     initContainers:
       - name: velero-plugin-for-aws
-        image: velero/velero-plugin-for-aws:v1.14.3-rc.2
+        image: velero/velero-plugin-for-aws:v1.14.4
         imagePullPolicy: IfNotPresent
         volumeMounts:
           - mountPath: /target

runbooks/serving/deployment.yaml

@@ -87,7 +87,7 @@ spec:
           # Renovate maintains this pin. nginx-unprivileged (not nginx) so the container can honour
           # runAsNonRoot: the stock nginx image's entrypoint needs root to drop privileges and to
           # bind :80. `stable-alpine` branch, pinned exactly.
-          image: nginxinc/nginx-unprivileged:1.30.4-alpine
+          image: nginxinc/nginx-unprivileged:1.31.7-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - name: http