Update all stable non-major dependencies

DRY_RUN=true, so no changes to Mailman are performed yet.

inventories/chaosknoten/host_vars/lists.sops.yaml

@@ -3,10 +3,10 @@ secret__lists__hyperkitty_api_key: ENC[AES256_GCM,data:byO7x/r3E9mwxOwiK0Is+Mp+d
 secret__lists__postgres_password: ENC[AES256_GCM,data:HcH4Lyw9uuuqXGrrXkUqzg==,iv:3adzec+Wnh37LjzwMp7zhWMf9jZzI6EyUmEGS9TUYBg=,tag:8/jZrUzkcM+U3nME6+DSSA==,type:str]
 secret__lists__rest_password: ENC[AES256_GCM,data:BMCNEikejiDET0Mdlrzfcg==,iv:U5hVjM/epfzz2m/wXKhYhwFI/3zKX7XS/UMlBqwTZNk=,tag:0n79+5mP7ocY7jVQmWm+WA==,type:str]
 secret__lists__web_secret_key: ENC[AES256_GCM,data:3DntszkNw5ciwRUJJdmHTGTpjm9ZMBf9wO3MHAeiXuw=,iv:GqqjRcg0zG193Y04UYIipB8BBk/JUtGvtTCVQ4HCjDw=,tag:aY4d+CPGxMvRz8t983p9sw==,type:str]
+secret__lists__keycloak_client_secret: ENC[AES256_GCM,data:9fJWkQegmwMe24LnXnPE5CfxDE5jSRDB77Hm1dzF06k=,iv:A5L21JQ3Nv5jDP6e72pp6qh1tytCwpTCyKbFdb2Pv9M=,tag:x8Ik/fRGfgoy96aHwif7kQ==,type:str]
 sops:
   age:
-    - recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
+    - enc: |
-      enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNUtVWVp5Z0pseFNLMURE
         MFY0V0E1K05sVGRnQ2lsMEhOWncwQzd5bURJCjE4cGxmeFNlS2FQb1JSZVhuNjFJ
@@ -14,8 +14,9 @@ sops:
         VFdtcTIwdWNLalFHdlh2dkdLWUhldVEKYygAfgJakHHw4NPfO1C3hd5HtJXMY87/
         Jh3LJn0sq+YKOVupd3G4FWVKozR78DHFNHvRmKQSR8OLmqEfi7w6xg==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-05-16T11:00:16Z"
+      recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
-  mac: ENC[AES256_GCM,data:vwQc2suUJ0KiSsYRcrvsYHNYF2c8SU58LxWoFpzTX5hSDNy8LOWJIa6Ouo8c7gk4gYB0mS/FbmgEo8LOCDvRKamfgrpZQ2wvxI7GdGRjR0LOsS8O2xZ8QZ3BK9DfEfnA5ESgzRzX6Iuc4ZBUGfAQoDDxXrnh2ogWUdYPC81T5qU=,iv:Vi74U97iZAqQ8DDW2p3ncg58l6+mxar4hC5f48AuPAQ=,tag:Jd09hXId+ogV4rB0AWS2NA==,type:str]
+  lastmodified: "2026-07-26T13:56:25Z"
+  mac: ENC[AES256_GCM,data:DuRHpgKU2l5R1vPYzc02qwOAWHeuzAJC7H2qeEW4L2pfsRfmKJz0LToxr+7Ap2sxUESUBMIEx0NktxYEvWoNhnNMtUwyWTPR8cOWVX/g7AayQj5aicS7nkrYW6B6Rnnl7tmzLbOCtmcgVyceFUGMm27O387zXUgrcMFb0hgRISg=,iv:6hD8HIfEKgcpdbOuY8HILrLbZT+/rXh6ZzJFBzD27uE=,tag:5No4EiP0zYuahGTYGcEY6w==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:46Z"
       enc: |-
@@ -188,4 +189,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.12.2
+  version: 3.13.2

inventories/chaosknoten/host_vars/netbox.yaml

@@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.6.4"
+netbox__version: "v4.6.5"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
 

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -32,7 +32,7 @@ services:
       - alertmanager_data:/alertmanager
 
   grafana:
-    image: docker.io/grafana/grafana:13.1.0
+    image: docker.io/grafana/grafana:13.1.1
     container_name: grafana
     ports:
       - 3000:3000
@@ -59,7 +59,7 @@ services:
       - /dev/null:/etc/prometheus/pve.yml
 
   loki:
-    image: docker.io/grafana/loki:3.7.3
+    image: docker.io/grafana/loki:3.7.4
     container_name: loki
     ports:
       - 13100:3100

resources/chaosknoten/lists/docker_compose/compose.yaml.j2

@@ -68,6 +68,22 @@ services:
     networks:
       mailman:
 
+  keycloaksync:
+    restart: unless-stopped
+    command: ["uv", "run", "main.py", "sync"]
+    environment:
+      - DRY_RUN=true
+      - KEYCLOAK_CLIENT_ID=mailman-sync
+      - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }}
+      - KEYCLOAK_REALM=ccchh
+      - KEYCLOAK_URL=https://id.hamburg.ccc.de
+      - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos
+      - MAILMAN_API_PASSWORD={{ secret__lists__rest_password }}
+      - MAILMAN_API_URL=http://mailman-core:8001/3.1
+    image: git.hamburg.ccc.de/ccchh/mailman-subscription-sync:latest
+    networks:
+      mailman:
+
 networks:
   mailman:
     driver: bridge

resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.26.0
+    image: docker.io/binwiederhier/ntfy:v2.26.3
     container_name: ntfy
     command:
       - serve

resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2

@@ -15,7 +15,7 @@ services:
       - pretalx_net
 
   redis:
-    image: docker.io/library/redis:8.8.0
+    image: docker.io/library/redis:8.8.1
     restart: unless-stopped
     volumes:
       - redis:/data
@@ -23,7 +23,7 @@ services:
       - pretalx_net
 
   static:
-    image: docker.io/library/nginx:1.31.2
+    image: docker.io/library/nginx:1.31.3
     restart: unless-stopped
     volumes:
       - public:/usr/share/nginx/html

resources/chaosknoten/tickets/docker_compose/compose.yaml.j2

@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:8.8.0
+    image: docker.io/library/redis:8.8.1
     ports:
       - "6379:6379"
     volumes: