chore(deps): renovate 2025-08-03

chore(deps): update proxmox-csi-plugin docker tag to v0.3.13 (#351)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update helm release argo-cd to v8.2.5 (#352)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update ghcr.io/advplyr/audiobookshelf docker tag to v2.27.0 (#353)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update netbird (#354)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update terraform kubernetes to v2.38.0 (#355)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update terraform google to ~> 6.46.0 (#357)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update media containers (#358)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update helm release cloudnative-pg to v0.25.0 (#360)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update helm release kube-prometheus-stack to v75.15.1 (#361)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update docker.io/adguard/adguardhome docker tag to v0.107.64 (#362)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency siderolabs/talos to v1.10.6 (#363)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update docker.io/grafana/grafana docker tag to v12 (#367)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update terraform proxmox to v0.81.0 (#366)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update cilium (#364)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

k8s/apps/media/arr/lidarr/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lidarr
-          image: ghcr.io/home-operations/lidarr:2.13.0 # renovate: docker=ghcr.io/home-operations/lidarr
+          image: ghcr.io/home-operations/lidarr:2.13.1 # renovate: docker=ghcr.io/home-operations/lidarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

k8s/apps/media/arr/prowlarr/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: prowlarr
-          image: ghcr.io/home-operations/prowlarr:2.0.1 # renovate: docker=ghcr.io/home-operations/prowlarr
+          image: ghcr.io/home-operations/prowlarr:2.0.2 # renovate: docker=ghcr.io/home-operations/prowlarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

k8s/apps/media/arr/radarr/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: radarr
-          image: ghcr.io/home-operations/radarr:5.27.1 # renovate: docker=ghcr.io/home-operations/radarr
+          image: ghcr.io/home-operations/radarr:5.27.3 # renovate: docker=ghcr.io/home-operations/radarr
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

k8s/apps/media/audiobookshelf/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.26.1 # renovate: docker=ghcr.io/advplyr/audiobookshelf
+          image: ghcr.io/advplyr/audiobookshelf:2.27.0 # renovate: docker=ghcr.io/advplyr/audiobookshelf
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

k8s/infra/controllers/argocd/kustomization.yaml

@@ -20,7 +20,7 @@ resources:
 helmCharts:
   - name: argo-cd
     repo: https://argoproj.github.io/argo-helm
-    version: 8.1.3
+    version: 8.2.5
     releaseName: "argocd"
     namespace: argocd
     valuesFile: values.yaml

k8s/infra/database/cnpg/kustomization.yaml

@@ -11,5 +11,5 @@ helmCharts:
     releaseName: cnpg
     namespace: cnpg-system
     includeCRDs: true
-    version: 0.24.0
+    version: 0.25.0
     valuesFile: values.yaml

k8s/infra/monitoring/kube-prometheus-stack/kustomization.yaml

@@ -11,6 +11,6 @@ helmCharts:
     repo: https://prometheus-community.github.io/helm-charts
     includeCRDs: true
     namespace: monitoring
-    version: 75.12.0
+    version: 75.15.1
     releaseName: kube-prometheus-stack
     valuesFile: ./values.yaml

k8s/infra/network/cilium/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io
-    version: 1.17.6 # renovate: github-releases=cilium/cilium
+    version: 1.18.0 # renovate: github-releases=cilium/cilium
     releaseName: "cilium"
     includeCRDs: true
     namespace: kube-system

k8s/infra/network/dns/adguard/deployment.yaml

@@ -49,7 +49,7 @@ spec:
               mountPath: /opt/adguardhome/conf
       containers:
         - name: adguard
-          image: docker.io/adguard/adguardhome:v0.107.63 # renovate: docker=docker.io/adguard/adguardhome
+          image: docker.io/adguard/adguardhome:v0.107.64 # renovate: docker=docker.io/adguard/adguardhome
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

k8s/infra/storage/proxmox-csi/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 helmCharts:
   - name: proxmox-csi-plugin
     repo: oci://ghcr.io/sergelogvinov/charts
-    version: 0.3.11
+    version: 0.3.13
     releaseName: proxmox-csi-plugin
     includeCRDs: true
     namespace: csi-proxmox

k8s/infra/vpn/netbird/agent/daemon-set.yaml

@@ -22,7 +22,7 @@ spec:
 #            value: "1"
       containers:
         - name: agent
-          image: docker.io/netbirdio/netbird:0.51.1 # renovate: docker=docker.io/netbirdio/netbird
+          image: docker.io/netbirdio/netbird:0.52.2 # renovate: docker=docker.io/netbirdio/netbird
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false

k8s/infra/vpn/netbird/dashboard/deployment.yaml

@@ -17,7 +17,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: dashboard
-          image: docker.io/netbirdio/dashboard:v2.14.0 # renovate: docker=docker.io/netbirdio/dashboard
+          image: docker.io/netbirdio/dashboard:v2.15.0 # renovate: docker=docker.io/netbirdio/dashboard
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false

k8s/infra/vpn/netbird/management/deployment.yaml

@@ -54,7 +54,7 @@ spec:
               mountPath: /tmp/netbird
       containers:
         - name: management
-          image: docker.io/netbirdio/management:0.51.1 # renovate: docker=docker.io/netbirdio/management
+          image: docker.io/netbirdio/management:0.52.2 # renovate: docker=docker.io/netbirdio/management
           args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console, --idp-sign-key-refresh-enabled ]
           securityContext:
             allowPrivilegeEscalation: false

k8s/infra/vpn/netbird/relay/deployment.yaml

@@ -16,7 +16,7 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       containers:
-        - image: docker.io/netbirdio/relay:0.51.1 # renovate: docker=docker.io/netbirdio/relay
+        - image: docker.io/netbirdio/relay:0.52.2 # renovate: docker=docker.io/netbirdio/relay
           imagePullPolicy: IfNotPresent
           name: relay
           securityContext:

k8s/infra/vpn/netbird/signal/deployment.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: signal
-          image: docker.io/netbirdio/signal:0.51.1 # renovate: docker=docker.io/netbirdio/signal
+          image: docker.io/netbirdio/signal:0.52.2 # renovate: docker=docker.io/netbirdio/signal
           args: [ --port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console ]
           securityContext:
             allowPrivilegeEscalation: false

tofu/home-assistant/main.tofu

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.80.0"
+      version = "0.81.0"
     }
   }
 }

tofu/kubernetes/providers.tofu

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "2.37.1"
+      version = "2.38.0"
     }
     proxmox = {
       source  = "bpg/proxmox"
-      version = "0.80.0"
+      version = "0.81.0"
     }
     talos = {
       source  = "siderolabs/talos"

tofu/kubernetes/talos/inline-manifests/cilium-install.yaml

@@ -59,7 +59,7 @@ spec:
       hostNetwork: true
       containers:
         - name: cilium-install
-          image: quay.io/cilium/cilium-cli:v0.18.5 # renovate: github-releases=cilium/cilium-cli
+          image: quay.io/cilium/cilium-cli:v0.18.6 # renovate: github-releases=cilium/cilium-cli
           env:
             - name: KUBERNETES_SERVICE_HOST
               valueFrom:
@@ -75,7 +75,7 @@ spec:
           command:
             - cilium
             - install
-            - --version=v1.17.6 # renovate: github-releases=cilium/cilium
+            - --version=v1.18.0 # renovate: github-releases=cilium/cilium
             - --set
             - kubeProxyReplacement=true
             - --values

tofu/kubernetes/talos_image.auto.tfvars

@@ -1,6 +1,6 @@
 talos_image = {
   version        = "v1.10.3"
-  update_version = "v1.10.5" # renovate: github-releases=siderolabs/talos
+  update_version = "v1.10.6" # renovate: github-releases=siderolabs/talos
   schematic_path = "talos/image/schematic.yaml"
   # Point this to a new schematic file to update the schematic
   # update_schematic_path = "talos/image/schematic.yaml"

tofu/state/gcs/providers.tofu

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 6.44.0"
+      version = "~> 6.46.0"
     }
   }
   encryption {

tofu/state/providers.tofu

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 6.44.0"
+      version = "~> 6.46.0"
     }
   }
   encryption {