Bump 33 apps to latest upstream versions

Patch/minor bumps:
- akaunting: 3.1.21 -> 3.2.3
- aptly: 1.6.2 -> 1.6.3
- baserow: 2.2.2 -> 2.4.1
- crowdsec: v1.7.8 -> v1.8.1
- docker-registry: 3.0.0 -> 3.1.2
- etherpad: 2.2.7 -> 2.6.1
- headlamp: v0.42.0 -> v0.46.0
- headscale: 0.29.1 -> 0.29.5
- indico: 3.3.12 -> 3.3.14
- karrot: v17.4.1 -> v17.4.2
- keila: 0.17.1 -> 0.30.3
- lemmy: 0.19.15 -> 0.19.19
- loomio: 3.0.24 -> 3.12.0
- mastodon: 4.5.3 -> 4.7.3
- mautic: 7.1.2 -> 7.2.1
- memcached: 1.6.32 -> 1.6.45
- mobilizon: 5.2.3 -> 5.2.4
- nocodb: 2026.04.1 -> 2026.09.1
- open-webui: 0.9.5 -> 0.12.3
- outline: 1.8.1 -> 1.11.0
- peertube: 8.2.1 -> 8.2.4
- pixelfed: 0.12.7 -> 0.15.1
- pretix: 2026.5.1 -> 2026.8.0
- synapse: v1.144.0 -> v1.163.0
- traefik: v3.4.1 -> v3.7.16
- typebot: 3.17.1 -> 3.19.1
- vaultwarden: 1.37.1 -> 1.37.4
- writefreely: 0.15.1 -> 0.17.2

Multi-file updates for apps with workers/sidekiq/streaming:
- mastodon (5 files), indico (3 files), karrot (4 files),
  lemmy (2 files), loomio (2 files), typebot (2 files),
  pixelfed (2 files), synapse (2 refs), pretix (2 refs),
  aptly (2 refs)

akaunting/versions/3/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: akaunting
-          image: akaunting/akaunting:3.1.21
+          image: akaunting/akaunting:3.2.3
           ports:
             - name: http
               containerPort: 80

akaunting/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.1.21-2
+version: 3.2.3
 requires:
 - name: mysql
 - name: smtp

aptly/versions/1/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: init-gpg
-          image: urpylka/aptly:1.6.2
+          image: urpylka/aptly:1.6.3
           command:
             - sh
             - -c
@@ -61,7 +61,7 @@ spec:
               mountPath: /opt/aptly
       containers:
         - name: aptly
-          image: urpylka/aptly:1.6.2
+          image: urpylka/aptly:1.6.3
           ports:
             - containerPort: 80
               name: http

aptly/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 1.6.2-4
+version: 1.6.3
 defaultConfig:
   namespace: aptly
   domain: aptly.{{ .cloud.domain }}

baserow/versions/2/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: baserow
-          image: baserow/baserow:2.2.2
+          image: baserow/baserow:2.4.1
           ports:
             - name: http
               containerPort: 80

baserow/versions/2/manifest.yaml

@@ -1,4 +1,4 @@
-version: 2.2.2-3
+version: 2.4.1
 requires:
 - name: postgres
 - name: redis

crowdsec/versions/v1/crowdsec-deployment.yaml

@@ -41,7 +41,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: crowdsec
-        image: crowdsecurity/crowdsec:v1.7.8
+        image: crowdsecurity/crowdsec:v1.8.1
         env:
         - name: COLLECTIONS
           value: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/whitelist-good-actors crowdsecurity/iptables crowdsecurity/linux"

crowdsec/versions/v1/manifest.yaml

@@ -1,4 +1,4 @@
-version: v1.7.8-4
+version: v1.8.1
 requires:
   - name: longhorn
   - name: traefik

docker-registry/versions/3/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       containers:
-        - image: registry:3.0.0
+        - image: registry:3.1.2
           name: docker-registry
           securityContext:
             allowPrivilegeEscalation: false

docker-registry/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.0.0-2
+version: 3.1.2
 defaultConfig:
   namespace: docker-registry
   host: registry.{{ .cloud.internalDomain }}

etherpad/versions/2/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: etherpad
-          image: etherpad/etherpad:2.2.7
+          image: etherpad/etherpad:2.6.1
           ports:
             - name: http
               containerPort: 9001

etherpad/versions/2/manifest.yaml

@@ -1,4 +1,4 @@
-version: 2.2.7-2
+version: 2.6.1
 requires:
 - name: postgres
 defaultConfig:

headlamp/versions/v0/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: headlamp
-          image: ghcr.io/headlamp-k8s/headlamp:v0.42.0
+          image: ghcr.io/headlamp-k8s/headlamp:v0.46.0
           args:
             - "-in-cluster"
             - "-plugins-dir=/headlamp/plugins"

headlamp/versions/v0/manifest.yaml

@@ -1,4 +1,4 @@
-version: v0.42.0-1
+version: v0.46.0
 defaultConfig:
   namespace: headlamp
   internalDomain: '{{ .cloud.internalDomain }}'

headscale/versions/1/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: headscale
-          image: headscale/headscale:v0.29.1
+          image: headscale/headscale:v0.29.5
           args: ["serve"]
           ports:
             - name: http

headscale/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.29.1-2
+version: 0.29.5
 scripts:
 - name: register-node
   description: Register a Tailscale node using the auth ID shown in the Tailscale

indico/versions/3/deployment-worker.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: config-init
-          image: getindico/indico:3.3.12
+          image: getindico/indico:3.3.14
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -61,7 +61,7 @@ spec:
               mountPath: /opt/indico/etc
       containers:
         - name: worker
-          image: getindico/indico:3.3.12
+          image: getindico/indico:3.3.14
           args: ["/opt/indico/run_celery.sh"]
           securityContext:
             allowPrivilegeEscalation: false
@@ -103,7 +103,7 @@ spec:
             - name: indico-custom
               mountPath: /opt/indico/custom
         - name: beat
-          image: getindico/indico:3.3.12
+          image: getindico/indico:3.3.14
           args: ["/opt/indico/run_celery.sh", "beat"]
           securityContext:
             allowPrivilegeEscalation: false

indico/versions/3/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: config-init
-          image: getindico/indico:3.3.12
+          image: getindico/indico:3.3.14
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -61,7 +61,7 @@ spec:
               mountPath: /opt/indico/etc
       containers:
         - name: indico
-          image: getindico/indico:3.3.12
+          image: getindico/indico:3.3.14
           args: ["/opt/indico/run_indico.sh"]
           ports:
             - name: http

indico/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.3.12-2
+version: 3.3.14
 requires:
 - name: postgres
 - name: redis

karrot/versions/1/deployment-backend.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: migrate
-          image: codeberg.org/karrot/karrot-backend:v17.4.1
+          image: codeberg.org/karrot/karrot-backend:v17.4.2
           command: ["/entrypoint.sh", "migrate"]
           env:
             - name: MODE
@@ -76,7 +76,7 @@ spec:
               mountPath: /app/uploads
       containers:
         - name: karrot-backend
-          image: codeberg.org/karrot/karrot-backend:v17.4.1
+          image: codeberg.org/karrot/karrot-backend:v17.4.2
           command: ["/entrypoint.sh", "server"]
           ports:
             - name: http

karrot/versions/1/deployment-frontend.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: karrot-frontend
-          image: codeberg.org/karrot/karrot-frontend:v17.4.1
+          image: codeberg.org/karrot/karrot-frontend:v17.4.2
           ports:
             - name: http
               containerPort: 8080

karrot/versions/1/deployment-worker.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: karrot-worker
-          image: codeberg.org/karrot/karrot-backend:v17.4.1
+          image: codeberg.org/karrot/karrot-backend:v17.4.2
           command: ["/entrypoint.sh", "worker"]
           env:
             - name: MODE

karrot/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: v17.4.1-1
+version: v17.4.2
 requires:
 - name: postgres
 - name: smtp

keila/versions/0/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: keila
-        image: "pentacent/keila:0.17.1"
+        image: "pentacent/keila:0.30.3"
         ports:
         - containerPort: 4000
         env:

keila/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.17.1-5
+version: 0.30.3
 requires:
 - name: postgres
 - name: smtp

lemmy/versions/0/deployment-backend.yaml

@@ -65,7 +65,7 @@ spec:
           mountPath: /config
       containers:
       - name: backend
-        image: dessalines/lemmy:0.19.15
+        image: dessalines/lemmy:0.19.19
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

lemmy/versions/0/deployment-ui.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: ui
-        image: dessalines/lemmy-ui:0.19.15
+        image: dessalines/lemmy-ui:0.19.19
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

lemmy/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.19.15-4
+version: 0.19.19
 requires:
 - name: postgres
 - name: smtp

loomio/versions/3/deployment-worker.yaml

@@ -17,7 +17,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: worker
-        image: loomio/loomio:3.0.24
+        image: loomio/loomio:3.12.0
         env:
         - name: TASK
           value: worker

loomio/versions/3/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: loomio
-        image: loomio/loomio:3.0.24
+        image: loomio/loomio:3.12.0
         command:
         - /bin/bash
         - -c

loomio/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.0.24-3
+version: 3.12.0
 requires:
 - name: postgres
   installed_as: postgres

mastodon/versions/4/db-init-job.yaml

@@ -108,7 +108,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: db-migrate
-        image: ghcr.io/mastodon/mastodon:v4.5.3
+        image: ghcr.io/mastodon/mastodon:v4.7.3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

mastodon/versions/4/deployment-sidekiq.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: sidekiq
-        image: ghcr.io/mastodon/mastodon:v4.5.3
+        image: ghcr.io/mastodon/mastodon:v4.7.3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

mastodon/versions/4/deployment-streaming.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: streaming
-        image: ghcr.io/mastodon/mastodon-streaming:v4.5.3
+        image: ghcr.io/mastodon/mastodon-streaming:v4.7.3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

mastodon/versions/4/deployment-web.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: web
-        image: ghcr.io/mastodon/mastodon:v4.5.3
+        image: ghcr.io/mastodon/mastodon:v4.7.3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

mastodon/versions/4/manifest.yaml

@@ -1,4 +1,4 @@
-version: 4.5.3-4
+version: 4.7.3
 requires:
 - name: postgres
 - name: redis

mastodon/versions/4/vapid-init-job.yaml

@@ -20,7 +20,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: vapid-init
-        image: ghcr.io/mastodon/mastodon:v4.5.3
+        image: ghcr.io/mastodon/mastodon:v4.7.3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

mautic/versions/7/deployment.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mautic
-          image: mautic/mautic:7.1.2-apache
+          image: mautic/mautic:7.2.1-apache
           ports:
             - name: http
               containerPort: 80

mautic/versions/7/manifest.yaml

@@ -1,4 +1,4 @@
-version: 7.1.2-3
+version: 7.2.1
 requires:
 - name: mysql
 - name: smtp

memcached/versions/1/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: memcached
-        image: "memcached:1.6.32-alpine"
+        image: "memcached:1.6.45-alpine"
         ports:
         - containerPort: 11211
           name: memcached

memcached/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 1.6.32-4
+version: 1.6.45
 defaultConfig:
   namespace: memcached
   host: memcached.memcached.svc.cluster.local

mobilizon/versions/5/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mobilizon
-          image: docker.io/kaihuri/mobilizon:5.2.3
+          image: docker.io/kaihuri/mobilizon:5.2.4
           ports:
             - name: http
               containerPort: 4000

mobilizon/versions/5/manifest.yaml

@@ -1,4 +1,4 @@
-version: 5.2.3-4
+version: 5.2.4
 requires:
 - name: postgres
 - name: smtp

nocodb/versions/2026/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: nocodb
-          image: nocodb/nocodb:2026.04.1
+          image: nocodb/nocodb:2026.09.1
           ports:
             - name: http
               containerPort: 8080

nocodb/versions/2026/manifest.yaml

@@ -1,4 +1,4 @@
-version: 2026.04.1-2
+version: 2026.09.1
 requires:
 - name: postgres
 defaultConfig:

open-webui/versions/0/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.9.5
+        image: ghcr.io/open-webui/open-webui:v0.12.3
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false

open-webui/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.9.5-5
+version: 0.12.3
 defaultConfig:
   namespace: open-webui
   storage: 2Gi

outline/versions/1/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: outline
-          image: outlinewiki/outline:1.8.1
+          image: outlinewiki/outline:1.11.0
           ports:
             - name: http
               containerPort: 3000

outline/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 1.8.1-2
+version: 1.11.0
 requires:
 - name: postgres
 - name: redis

peertube/versions/8/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: peertube
-          image: chocobozzz/peertube:v8.2.1
+          image: chocobozzz/peertube:v8.2.4
           ports:
             - name: http
               containerPort: 9000

peertube/versions/8/manifest.yaml

@@ -1,4 +1,4 @@
-version: 8.2.1-2
+version: 8.2.4
 requires:
 - name: postgres
 - name: redis

pixelfed/versions/0/deployment-worker.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: pixelfed-worker
-          image: ghcr.io/mattlqx/docker-pixelfed:v0.12.7-nginx
+          image: ghcr.io/mattlqx/docker-pixelfed:v0.15.1-nginx
           command:
             - php
             - artisan

pixelfed/versions/0/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: pixelfed
-          image: ghcr.io/mattlqx/docker-pixelfed:v0.12.7-nginx
+          image: ghcr.io/mattlqx/docker-pixelfed:v0.15.1-nginx
           ports:
             - name: http
               containerPort: 80

pixelfed/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.12.7-2
+version: 0.15.1
 requires:
 - name: postgres
 - name: redis

pretix/versions/2026/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: config-init
-          image: pretix/standalone:2026.5.1
+          image: pretix/standalone:2026.8.0
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -66,7 +66,7 @@ spec:
               mountPath: /etc/pretix
       containers:
         - name: pretix
-          image: pretix/standalone:2026.5.1
+          image: pretix/standalone:2026.8.0
           ports:
             - name: http
               containerPort: 80

pretix/versions/2026/manifest.yaml

@@ -1,4 +1,4 @@
-version: 2026.5.1-2
+version: 2026.8.0
 requires:
 - name: postgres
 - name: redis

synapse/versions/v1/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
         - name: generate-signing-key
-          image: "matrixdotorg/synapse:v1.144.0"
+          image: "matrixdotorg/synapse:v1.163.0"
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -79,7 +79,7 @@ spec:
             readOnlyRootFilesystem: false
       containers:
         - name: synapse
-          image: "matrixdotorg/synapse:v1.144.0"
+          image: "matrixdotorg/synapse:v1.163.0"
           command: ["/bin/sh", "-c"]
           args:
             - |

synapse/versions/v1/manifest.yaml

@@ -1,4 +1,4 @@
-version: v1.144.0-13
+version: v1.163.0
 requires:
 - name: postgres
 - name: redis

traefik/versions/v3/deployment.yaml

@@ -40,7 +40,7 @@ spec:
       terminationGracePeriodSeconds: 60
       hostNetwork: false
       containers:
-      - image: docker.io/traefik:v3.4.1
+      - image: docker.io/traefik:v3.7.16
         imagePullPolicy: IfNotPresent
         name: traefik
         resources:

traefik/versions/v3/manifest.yaml

@@ -1,4 +1,4 @@
-version: v3.4-1
+version: v3.7.16
 requires:
   - name: metallb
 defaultConfig:

typebot/versions/3/deployment-builder.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: typebot-builder
-          image: baptistearno/typebot-builder:3.17.1
+          image: baptistearno/typebot-builder:3.19.1
           ports:
             - name: http
               containerPort: 3000

typebot/versions/3/deployment-viewer.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: typebot-viewer
-          image: baptistearno/typebot-viewer:3.17.1
+          image: baptistearno/typebot-viewer:3.19.1
           ports:
             - name: http
               containerPort: 3000

typebot/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.17.1-2
+version: 3.19.1
 requires:
 - name: postgres
 - name: smtp

vaultwarden/versions/1/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:1.37.1
+          image: vaultwarden/server:1.37.4
           ports:
             - name: http
               containerPort: 80

vaultwarden/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 1.37.1-1
+version: 1.37.4
 requires:
 - name: postgres
 - name: smtp

writefreely/versions/0/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: writefreely
-          image: jrasanen/writefreely:v0.15.1
+          image: jrasanen/writefreely:v0.17.2
           ports:
             - name: http
               containerPort: 8080

writefreely/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.15.1-3
+version: 0.17.2
 requires:
 - name: mysql
 defaultConfig: