chore(deps): update externalsecrets docker tag to v5

[renovate]

This PR contains the following updates:

Package	Update	Change
externalsecrets	major	4.6.0 → 5.0.0

---

Release Notes

lunarys/generic-helm-chart (externalsecrets)

v5.0.0

Compare Source

Features

• security: stop mounting the API token into pods by default (7a32f1c)

BREAKING CHANGES

• security: pods no longer receive a ServiceAccount token unless
  serviceAccount.automountToken is set to true. Workloads using an
  in-cluster Kubernetes client, or sidecars injected by a mutating webhook
  that needs the token, must opt in.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Helm Template Diff — cloudnative-pg

6 changed lines

--- /tmp/old.yaml	2026-08-28 08:05:14.003335869 +0000
+++ /tmp/new.yaml	2026-08-28 08:05:13.754329969 +0000
@@ -1,7 +1,7 @@
 Saving 1 charts
 Downloading externalsecrets from repo oci://ghcr.io/lunarys/charts
-Pulled: ghcr.io/lunarys/charts/externalsecrets:4.6.0
-Digest: sha256:2fc9478fdbdd17a925c03c6a1dc3751f19500dd136f7774d09cc94ab8bc6198c
+Pulled: ghcr.io/lunarys/charts/externalsecrets:5.0.0
+Digest: sha256:177d689906f70fd37824e0319a0e4a1fec399e4530b02dded00ad1f22d12ff42
 Deleting outdated charts
 Error: postgresdb/templates/service-rw.yaml:8:35
   executing "postgresdb/templates/service-rw.yaml" at <include "postgresdb.cnpg.clusterName" .>:

[lunarys]

Renovate Review: externalsecrets 4.6.0 → 5.0.0 (major, cloudnative-pg app)

Risk: 🟡 MEDIUM

Check	Result
Inputs	Partial — Release Notes present with an explicit BREAKING CHANGES block; one diff comment exists (03-apps-apps-cloudnative-pg), but it's blocked by a render error before any manifests are produced (see Rendered diff), so there's no template-output visibility for this app's secrets rendering.
Description vs. diff	Mismatch — see Details: scope silently exceeds the PR's single-package description.
Rendered diff	Not usable as evidence — see Details (pre-existing render error masks all output).
Changelog vs. config	No overlap in what's visible; can't be fully confirmed for this app due to the render error below.

Details:

• Table names only externalsecrets, and the PR does contain the expected pinned bump in 03_apps/apps/cloudnative-pg/Chart.yaml (4.6.0→5.0.0) — but it also rewrites the fleet-wide default secretsChartVersion in 03_apps/values.yaml (4.6.0→5.0.0). That default is consumed by 03_apps/charts/application-wrapper/templates/_application.tpl for every app that has a secrets.yaml file without its own version: override. A repo-wide search found exactly four such apps: step-ca, crowdsec, longhorn, and authentik — none pins its own version, so all four get silently bumped to externalsecrets v5.0.0 by this PR, with no mention in the title/table, no file of theirs changed, and consequently zero diff-bot coverage. This is the fleet-wide-default scope gap called out in the review procedure's input-completeness check.
• The cloudnative-pg diff comment shows the correct digest bump (ghcr.io/lunarys/charts/externalsecrets:4.6.0→5.0.0) but the overall Helm render then aborts: Error: postgresdb/templates/service-rw.yaml:8:35 executing "postgresdb/templates/service-rw.yaml" at <include "postgresdb.cnpg.clusterName" .>. This error line is unprefixed context — identical in both /tmp/old.yaml and /tmp/new.yaml — so it's pre-existing on both renders and not introduced by this PR. It does mean, however, that the diff produces zero actual manifest output, so it cannot confirm or rule out any effect of the ServiceAccount-token breaking change on whatever this subchart creates for cloudnative-pg.
• cloudnative-pg/Chart-values.yaml's externalsecrets.secrets.* block only maps secret fields (s3-credentials, db-superuser); no serviceAccount/automountToken key. Repo-wide search found no app (including the 4 default-inheriting apps above) setting serviceAccount/automountToken anywhere, so nothing currently opts in to the removed default token mount — but this can't be verified specifically for cloudnative-pg's own render given the error above.

Why MEDIUM: Major bump with a stated breaking change; the changed-file scope silently exceeds the PR's stated single-package description (reaches 4 more apps via a fleet-wide default with no review trail); and the one available diff comment can't serve as evidence due to a render error — three independent Medium triggers. Not High: the render error predates this PR (pre-existing context line, not introduced), and no live override was found to intersect the breaking change in what is visible.

---

Generated by Claude Code