Update ghcr.io/immich-app/immich-server Docker tag to v1.137.3

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.18.2` -> `0.19.0` |

---

### Release Notes

<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>

### [`v0.19.0`](https://github.com/external-secrets/external-secrets/releases/tag/v0.19.0)

[Compare Source](https://github.com/external-secrets/external-secrets/compare/v0.18.2...v0.19.0)

#### **BREAKING CHANGE**

🔴 🔴  BREAKING CHANGE 🔴 🔴

Please note that this a breaking change because our CRDs are now too big. Meaning a simple kubectl apply or Argo's default client side apply WILL NOT WORK! You have to add `--server-side` to kubectl apply and in argo add:

```yaml
spec:
  project: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true
```

for it to correctly install the CRDs. Thank you.

Image: `ghcr.io/external-secrets/external-secrets:v0.19.0`
Image: `ghcr.io/external-secrets/external-secrets:v0.19.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v0.19.0-ubi-boringssl`

#### What's Changed

- chore: release helm chart for v0.18.2 by [@&#8203;Skarlso](https://github.com/Skarlso) in https://github.com/external-secrets/external-secrets/pull/4985
- chore(deps): bump golang from `ee7ff13` to `10f549d` in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/4997
- chore(deps): bump golang from `68932fa` to `68932fa` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5000
- chore(deps): bump mkdocs-material from 9.6.14 to 9.6.15 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/4998
- chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5001
- chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5003
- chore(deps): bump aquasecurity/trivy-action from 0.31.0 to 0.32.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5002
- fix: do not turn original value into string on value scope by [@&#8203;Skarlso](https://github.com/Skarlso) in https://github.com/external-secrets/external-secrets/pull/5011
- fix: add uuid in edit and view clusterroles by [@&#8203;sylvainOL](https://github.com/sylvainOL) in https://github.com/external-secrets/external-secrets/pull/5017
- chore: update dependencies by [@&#8203;eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in https://github.com/external-secrets/external-secrets/pull/4999
- fix: template data should not be the secret Data itself by [@&#8203;gusfcarvalho](https://github.com/gusfcarvalho) in https://github.com/external-secrets/external-secrets/pull/5023
- Fix: Return appropriate error in ValidateStore by [@&#8203;prakash-218](https://github.com/prakash-218) in https://github.com/external-secrets/external-secrets/pull/5019
- feat(helm): allow to set init containers by [@&#8203;rclsilver](https://github.com/rclsilver) in https://github.com/external-secrets/external-secrets/pull/4745
- chore(deps): bump certifi from 2025.6.15 to 2025.7.14 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5032
- Fix: Remove root/buildinfo from ubi build files by [@&#8203;bainsy88](https://github.com/bainsy88) in https://github.com/external-secrets/external-secrets/pull/5037
- chore(deps): bump ubi8/ubi from `19eae3d` to `c0b0729` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5033
- chore(deps): bump golang from 1.24.4-bookworm to 1.24.5-bookworm in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5029
- chore(deps): bump golang from 1.24.4 to 1.24.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5034
- chore: update dependencies by [@&#8203;eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in https://github.com/external-secrets/external-secrets/pull/5031
- Add Red Hat OpenShift in Adopters by [@&#8203;KeenonLee](https://github.com/KeenonLee) in https://github.com/external-secrets/external-secrets/pull/5039
- fix: remove authentication option with JWT token from STSSessionToken generator by [@&#8203;Skarlso](https://github.com/Skarlso) in https://github.com/external-secrets/external-secrets/pull/5026
- fix: add validation constraints to ExternalSecretRewrite  by [@&#8203;Aakkash-Suresh](https://github.com/Aakkash-Suresh) in https://github.com/external-secrets/external-secrets/pull/5006
- fix: stability support matrix by [@&#8203;gusfcarvalho](https://github.com/gusfcarvalho) in https://github.com/external-secrets/external-secrets/pull/5043
- docs(decoding-strategy): clarify base64 auto-detection limitations by [@&#8203;orymate](https://github.com/orymate) in https://github.com/external-secrets/external-secrets/pull/5004
- feat(infisical): auth methods by [@&#8203;DanielHougaard](https://github.com/DanielHougaard) in https://github.com/external-secrets/external-secrets/pull/5040
- chore(deps): bump alpine from 3.22.0 to 3.22.1 in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5046
- chore(aws): parameterstore unit tests improvement by [@&#8203;ivankatliarchuk](https://github.com/ivankatliarchuk) in https://github.com/external-secrets/external-secrets/pull/4986
- fix(helm): grafana dashboard: fix heatmaps to actually be heatmaps, not time series by [@&#8203;desaintmartin](https://github.com/desaintmartin) in https://github.com/external-secrets/external-secrets/pull/5069
- chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5047
- chore(deps): bump step-security/harden-runner from 2.12.2 to 2.13.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5048
- chore(deps): bump golang from `ddf5200` to `daae04e` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5049
- chore(deps): bump alpine from `8a1f59f` to `4bcff63` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5051
- chore(deps): bump alpine from `8a1f59f` to `4bcff63` in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5052
- chore(deps): bump mkdocs-material from 9.6.15 to 9.6.16 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5077
- Add SelfSubjectAccessReview as a fallback for failing SelfSubjectRulesReview by [@&#8203;alvin-rw](https://github.com/alvin-rw) in https://github.com/external-secrets/external-secrets/pull/5025
- chore(deps): bump golang from `69adc37` to `ef8c5c7` in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5076
- chore(deps): bump ubi8/ubi from `c0b0729` to `785d38c` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5075
- chore(deps): bump github/codeql-action from 3.29.2 to 3.29.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5072
- chore(deps): bump anchore/sbom-action from 0.20.2 to 0.20.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/external-secrets/external-secrets/pull/5073
- SSHKey generator by [@&#8203;dex4er](https://github.com/dex4er) in https://github.com/external-secrets/external-secrets/pull/5083
- fix: restore AWS credential chain resolution for ECRAuthorizationToken generator by [@&#8203;aditmeno](https://github.com/aditmeno) in https://github.com/external-secrets/external-secrets/pull/5082
- fix(helm): grafana dashboard: add widget for sum of not ready secrets by [@&#8203;desaintmartin](https://github.com/desaintmartin) in https://github.com/external-secrets/external-secrets/pull/5086
- feat(aws): secretsmanager to update/patch/delete tags by [@&#8203;ivankatliarchuk](https://github.com/ivankatliarchuk) in https://github.com/external-secrets/external-secrets/pull/4984
- fix: update the e2e test with the new store status value by [@&#8203;Skarlso](https://github.com/Skarlso) in https://github.com/external-secrets/external-secrets/pull/5089
- fix: correct usage of if in dlc and update for server side apply by [@&#8203;Skarlso](https://github.com/Skarlso) in https://github.com/external-secrets/external-secrets/pull/5092

#### New Contributors

- [@&#8203;sylvainOL](https://github.com/sylvainOL) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5017
- [@&#8203;prakash-218](https://github.com/prakash-218) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5019
- [@&#8203;rclsilver](https://github.com/rclsilver) made their first contribution in https://github.com/external-secrets/external-secrets/pull/4745
- [@&#8203;bainsy88](https://github.com/bainsy88) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5037
- [@&#8203;KeenonLee](https://github.com/KeenonLee) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5039
- [@&#8203;orymate](https://github.com/orymate) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5004
- [@&#8203;desaintmartin](https://github.com/desaintmartin) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5069
- [@&#8203;alvin-rw](https://github.com/alvin-rw) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5025
- [@&#8203;dex4er](https://github.com/dex4er) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5083
- [@&#8203;aditmeno](https://github.com/aditmeno) made their first contribution in https://github.com/external-secrets/external-secrets/pull/5082

**Full Changelog**: https://github.com/external-secrets/external-secrets/compare/v0.18.2...v0.19.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: #1114
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/applications/immich/values.yaml

@@ -9,7 +9,7 @@ immich:
         main:
           image:
             repository: ghcr.io/immich-app/immich-server
-            tag: v1.132.3
+            tag: v1.137.3
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/platform/external-secrets/Chart.yaml

@@ -12,7 +12,7 @@ sources:
   - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
 dependencies:
   - name: external-secrets
-    version: 0.18.2
+    version: 0.19.0
     repository: https://charts.external-secrets.io
 icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
 appVersion: 0.17.0