Update application and chart versions to latest

Bumps every outdated image and chart except databases, which are
deliberately left on their current versions.

Applications:
  authentik       2026.5.2 -> 2026.8.0 (server and worker)
  immich          v2.7.5 -> v3.1.0
  gitea           1.25 -> 1.27.2
  gotify          2.9.1 -> 3.0.0
  uptime-kuma     2.2.1 -> 2.5.3
  zipline         4.5.3 -> 4.7.0
  outline         1.8.1 -> 1.9.2
  reactive-resume v5.0 -> v5.2.8
  netbootxyz      nbxyz18 -> nbxyz24
  bentopdf        v2.8.2 -> v2.8.7
  jellyfin        10.11.9 -> 10.11.11
  gitea runner init busybox 1.37.0 -> 1.38.0

Infra:
  kube-vip                    v0.9.1 -> v1.2.3
  victoria-metrics-k8s-stack  0.77.0 -> 0.91.2
  intel-device-plugins        v0.35.0 -> v0.36.0
  crowdsec-envoy-bouncer      0.6.3 -> 0.8.0

Immich v3 drops pgvecto.rs support. Verified the live database already
runs vchord 0.4.3 and pgvector 0.8.1 with no pgvecto.rs extension, both
inside the ranges v3 accepts, so no database change is required.

The victoria-metrics chart renamed defaultRules.create to
defaultRules.enabled at both the top level and per group. Migrated those
keys so the etcd, kubeScheduler, kubernetesSystemControllerManager and
kubernetesSystemScheduler exclusions keep applying. Without the rename
those groups revert to enabled and alert on control-plane components
that k3s runs embedded.

That chart also moved default rules and dashboards to a runtime sync job
instead of templating them, so ArgoCD will prune the VMRules and
dashboard ConfigMaps it currently owns and the job will recreate them.

kube-vip is not managed by ArgoCD. The manifest change is inert until
applied by hand.

applications/authentik/server/authentik-server-deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["server"]
           ports:

applications/authentik/worker/authentik-worker-deployment.yaml

@@ -19,7 +19,7 @@ spec:
         runAsUser: 0
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["worker"]
           envFrom:

applications/bentopdf/bentopdf-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
           - name: bentopdf
-            image: ghcr.io/alam00000/bentopdf:v2.8.2-amd64
+            image: ghcr.io/alam00000/bentopdf:v2.8.7-amd64
             resources:
               requests:
                 cpu: 50m

applications/gitea/gitea/gitea-statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.25
+          image: docker.gitea.com/gitea:1.27.2
           resources:
             requests:
               cpu: 200m

applications/gitea/runner/values.yaml

@@ -144,7 +144,7 @@ init:
   image:
     repository: busybox
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "1.37.0"
+    tag: "1.38.0"
 
 ## Specify an existing token secret
 ##

applications/gotify/gotify/statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: gotify
-          image: gotify/server:2.9.1
+          image: gotify/server:3.0.0
           resources:
             requests:
               cpu: 50m

applications/immich/immich/immich-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
       - name: immich
-        image: ghcr.io/immich-app/immich-server:v2.7.5
+        image: ghcr.io/immich-app/immich-server:v3.1.0
         resources:
           requests:
             memory: "256Mi"

applications/jellyfin/jellyfin-statefulset.yaml

@@ -20,7 +20,7 @@ spec:
         gpu: "true"
       containers:
       - name: jellyfin
-        image: jellyfin/jellyfin:10.11.9
+        image: jellyfin/jellyfin:10.11.11
         ports:
         - containerPort: 8096
         resources:

applications/netbootxyz/netbootxyz-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: netbootxyz
-          image: netbootxyz/netbootxyz:0.7.6-nbxyz18
+          image: netbootxyz/netbootxyz:0.7.6-nbxyz24
           resources:
             requests:
               cpu: 100m

applications/outline/outline/outline-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: outline
-          image: docker.getoutline.com/outlinewiki/outline:1.8.1
+          image: docker.getoutline.com/outlinewiki/outline:1.9.2
           resources:
             requests:
               memory: "512Mi"

applications/react-resume/resume/react-resume-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: resume
-          image: ghcr.io/amruthpillai/reactive-resume:v5.0
+          image: ghcr.io/amruthpillai/reactive-resume:v5.2.8
           ports:
             - containerPort: 3000
           resources:

applications/uptime-kuma/uptime-kuma/statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: uptime-kuma
-          image: louislam/uptime-kuma:2.2.1
+          image: louislam/uptime-kuma:2.5.3
           resources:
             requests:
               cpu: 100m

applications/victoria-metrics/values.yaml

@@ -24,16 +24,16 @@ defaultDashboards:
       enabled: true
 
 defaultRules:
-  create: true
+  enabled: true
   groups:
     etcd:
-      create: false
+      enabled: false
     kubeScheduler:
-      create: false
+      enabled: false
     kubernetesSystemControllerManager:
-      create: false
+      enabled: false
     kubernetesSystemScheduler:
-      create: false
+      enabled: false
 
 vmsingle:
   enabled: true

applications/zipline/zipline/zipline-statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: zipline
-          image: diced/zipline:4.5.3
+          image: diced/zipline:4.7.0
           resources:
             requests:
               cpu: 200m

infra/argocd/applications/crowdsec-envoy-bouncer-application.yaml

@@ -10,7 +10,7 @@ spec:
     #   argocd repo add ghcr.io/kdwils/charts --type helm --name kdwils --enable-oci
     - repoURL: ghcr.io/kdwils/charts
       chart: envoy-proxy-bouncer
-      targetRevision: 0.6.3
+      targetRevision: 0.8.0
       helm:
         releaseName: crowdsec-envoy-bouncer
         valueFiles:

infra/argocd/applications/intel-gpu-application.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git
     path: deployments/gpu_plugin/overlays/nfd_labeled_nodes
-    targetRevision: v0.35.0
+    targetRevision: v0.36.0
   destination:
     server: https://kubernetes.default.svc
     namespace: kube-system

infra/argocd/applications/intel-nfd-application.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git
     path: deployments/nfd
-    targetRevision: v0.35.0
+    targetRevision: v0.36.0
   destination:
     server: https://kubernetes.default.svc
     namespace: node-feature-discovery

infra/argocd/applications/intel-nfd-rules-application.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: https://github.com/intel/intel-device-plugins-for-kubernetes.git
     path: deployments/nfd/overlays/node-feature-rules
-    targetRevision: v0.35.0
+    targetRevision: v0.36.0
   destination:
     server: https://kubernetes.default.svc
     namespace: node-feature-discovery

infra/argocd/applications/victoria-metrics-application.yaml

@@ -8,7 +8,7 @@ spec:
   sources:
     - repoURL: https://victoriametrics.github.io/helm-charts/
       chart: victoria-metrics-k8s-stack
-      targetRevision: 0.77.0
+      targetRevision: 0.91.2
       helm:
         # Release name kept short to avoid label length >63 chars on alertmanager StatefulSet pods
         releaseName: vm

infra/kubevip/kubevip-daemonset.yaml

@@ -4,7 +4,7 @@ metadata:
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: kube-vip-ds
-    app.kubernetes.io/version: v0.9.1
+    app.kubernetes.io/version: v1.2.3
   name: kube-vip-ds
   namespace: kube-system
 spec:
@@ -16,7 +16,7 @@ spec:
       creationTimestamp: null
       labels:
         app.kubernetes.io/name: kube-vip-ds
-        app.kubernetes.io/version: v0.9.1
+        app.kubernetes.io/version: v1.2.3
     spec:
       affinity:
         nodeAffinity:
@@ -61,7 +61,7 @@ spec:
           value: 10.8.11.200 
         - name: prometheus_server
           value: :2112
-        image: ghcr.io/kube-vip/kube-vip:v0.9.1
+        image: ghcr.io/kube-vip/kube-vip:v1.2.3
         imagePullPolicy: IfNotPresent
         name: kube-vip
         resources: {}