chore(apps): mirror-backed bumps — vaultwarden, nbxplorer, home-assistant (PENDING)

Prepared patch-level bumps with no data migration, held here until the
three images can be mirrored to source.archipelago-foundation.org/lfg2025
(currently blocked: the only registry-push credential on record for the
lfg2025 namespace is dead, and the ai account cannot push user-namespace
packages it does not own):

  vaultwarden       1.37.1-alpine -> 1.37.2-alpine  (docker.io/vaultwarden/server)
  archy-nbxplorer   2.6.0         -> 2.6.11         (docker.io/nicolasdorier/nbxplorer)
  home-assistant    2026.8.2      -> 2026.8.3       (docker.io/homeassistant/home-assistant)

All three target tags verified present upstream. To land: mirror the
images, merge this branch into main, regenerate + re-sign the catalog.

apps/archy-nbxplorer/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: archy-nbxplorer
   name: NBXplorer
-  version: 2.6.0
+  version: 2.6.11
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: BTCPay blockchain indexer service.
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.0
+    image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.11
     pull_policy: if-not-present
     network: archy-net
     secret_env:

apps/home-assistant/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: homeassistant
   name: Home Assistant
-  version: 2026.7.3
+  version: 2026.8.3
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Open source home automation platform. Control and monitor your smart home devices.
   
   container:
-    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3
     pull_policy: if-not-present
     network: pasta
     

apps/vaultwarden/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: vaultwarden
   name: Vaultwarden
-  version: 1.30.0
+  version: 1.37.2
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Self-hosted password vault with zero-knowledge encryption.
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine
+    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine
     pull_policy: if-not-present
     network: pasta
 

scripts/image-versions.sh

@@ -38,18 +38,18 @@ MARIADB_IMAGE="$ARCHY_REGISTRY/mariadb:11.4.10"
 
 # BTCPay
 BTCPAY_IMAGE="docker.io/btcpayserver/btcpayserver:2.4.3"
-NBXPLORER_IMAGE="$ARCHY_REGISTRY/nbxplorer:2.6.0"
+NBXPLORER_IMAGE="$ARCHY_REGISTRY/nbxplorer:2.6.11"
 POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
 BTCPAY_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
 
 # Apps
-HOMEASSISTANT_IMAGE="$ARCHY_REGISTRY/home-assistant:2026.8.2"
+HOMEASSISTANT_IMAGE="$ARCHY_REGISTRY/home-assistant:2026.8.3"
 GRAFANA_IMAGE="$ARCHY_REGISTRY/grafana:10.2.0"
 UPTIME_KUMA_IMAGE="$ARCHY_REGISTRY/uptime-kuma:1"
 JELLYFIN_IMAGE="$ARCHY_REGISTRY/jellyfin:10.11.11"
 PHOTOPRISM_IMAGE="$ARCHY_REGISTRY/photoprism:240915"
 OLLAMA_IMAGE="$ARCHY_REGISTRY/ollama:latest"
-VAULTWARDEN_IMAGE="$ARCHY_REGISTRY/vaultwarden:1.37.1-alpine"
+VAULTWARDEN_IMAGE="$ARCHY_REGISTRY/vaultwarden:1.37.2-alpine"
 NEXTCLOUD_IMAGE="$ARCHY_REGISTRY/nextcloud:29"
 SEARXNG_IMAGE="$ARCHY_REGISTRY/searxng:latest"
 # OnlyOffice removed — incompatible with rootless Podman (internal postgres/rabbitmq fail)