chore(deps): update externalsecrets docker tag to v4.6.0

[renovate]

This PR contains the following updates:

Package	Update	Change
externalsecrets	minor	4.3.0 → 4.6.0

---

Release Notes

lunarys/generic-helm-chart (externalsecrets)

v4.6.0

Compare Source

Features

• network-policy: allow multiple local subnet cidr (c0115b7)

v4.5.0

Compare Source

Bug Fixes

• config: enforce single key restriction for subPath mounting in config values (7d3e95d)
• cronjob: remove default schedule (08cab12)

Features

• cronjob: add initial generic-cronjob implementation (fbdbff2)
• cronjob: enhance generic CronJob with service account support and network policy integration (cf2cc06)
• cronjob: integrate custom network labels for enhanced network policy support (9d8c379)

v4.4.0

Compare Source

Bug Fixes

• service: decide ipFamilyPolicy/ipFamilies independently; tidy type resolver (5870c44)

Features

• service: add optional static nodePort per port (1349b52)
• service: auto-disable NodePort allocation on derived LoadBalancer services (31306b4)
• service: intent-based LoadBalancer IP exposure via Cilium LB-IPAM (d2da917)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[lunarys]

Renovate Review: externalsecrets 4.3.0 → 4.6.0 (minor)

Risk: 🟡 MEDIUM

Check	Result
Inputs	✅ complete
Description vs. diff	⚠️ scope wider than described
Rendered diff	⚠️ uninformative — pre-existing render error, not from this PR
Changelog vs. config	✅ no overlap for cloudnative-pg

Details:

• The diff touches two files, not just the named component: 03_apps/apps/cloudnative-pg/Chart.yaml (4.3.0 → 4.6.0, as described) and 03_apps/values.yaml's secretsChartVersion default (also 4.3.0 → 4.6.0) — the latter is the repo-wide default used by every app that doesn't pin its own externalsecrets version, so the real blast radius extends beyond cloudnative-pg.
• The rendered-diff workflow (.github/workflows/pr-diff.yml) falls back to writing stderr into the diff when a render produces no stdout, so a passing check run doesn't guarantee a clean render. The cloudnative-pg diff body shows Error: postgresdb/templates/service-rw.yaml:8:35 executing "postgresdb/templates/service-rw.yaml" at <include "postgresdb.cnpg.clusterName" .>: on unprefixed context lines (identical before and after) — this is a pre-existing render failure in the postgresdb chart, not introduced by this version bump, but it means the diff gives no real signal on what actually changes for this app.
• Changelog for 4.4.0–4.6.0 (service ipFamily/nodePort/LB-IPAM changes, cronjob feature plus subPath/schedule fixes, network-policy multi-subnet-cidr) checked against cloudnative-pg's externalsecrets: overrides (Chart-values.yaml / -prod / -test) — these only configure the secrets map (s3-credentials, db-superuser); no cronjob, service, or network-policy keys are set there, so none of these changes apply to this app.

Why medium: the actual change scope exceeds what the PR describes (repo-wide default bump, not just cloudnative-pg), and the rendered diff can't confirm the real effect due to a pre-existing render error.

---

Generated by Claude Code

[github-actions]

Helm Template Diff — cloudnative-pg

6 changed lines

--- /tmp/old.yaml	2026-07-31 14:11:01.869335008 +0000
+++ /tmp/new.yaml	2026-07-31 14:11:01.543327427 +0000
@@ -1,7 +1,7 @@
 Saving 1 charts
 Downloading externalsecrets from repo oci://ghcr.io/lunarys/charts
-Pulled: ghcr.io/lunarys/charts/externalsecrets:4.3.0
-Digest: sha256:40fb5b594d37233b952d408185112d68a27cf1d48a7af1a9d60c9f2fc673de6b
+Pulled: ghcr.io/lunarys/charts/externalsecrets:4.6.0
+Digest: sha256:2fc9478fdbdd17a925c03c6a1dc3751f19500dd136f7774d09cc94ab8bc6198c
 Deleting outdated charts
 Error: postgresdb/templates/service-rw.yaml:8:35
   executing "postgresdb/templates/service-rw.yaml" at <include "postgresdb.cnpg.clusterName" .>: