chore(deps): update renovate/renovate docker tag to v43.280.4

Release-Bump: minor

.gitea/workflows/renovate.yml

@@ -19,7 +19,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:43.252.1
+            renovate/renovate:43.280.4
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the
@@ -52,7 +52,7 @@ jobs:
           fi
           BUMPS=$(git log "${LATEST}..origin/main" --author='renovate@larvit.se' \
                   --format='%(trailers:key=Release-Bump,valueonly)' | { grep -vx '' || true; })
-          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.18.0-alpine3.24 \
+          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.16.0-alpine3.24 \
                  node auto-release/next-version.ts "$LATEST" $BUMPS)
           echo "Releasing $LATEST -> $NEXT"
           git tag "$NEXT" origin/main

compose.override.yml

@@ -36,7 +36,7 @@ services:
   # Dev mail catcher — Kratos recovery/verification emails land here (web UI on 8025).
   # kratos.yml points the courier at smtp://mailpit:1025; prod uses a real SMTP via env.
   mailpit:
-    image: axllent/mailpit:v1.30.3
+    image: axllent/mailpit:v1.30.5
     ports:
       - "8025:8025"
     restart: unless-stopped

package.json

@@ -24,7 +24,7 @@
   },
   "devDependencies": {
     "@types/ejs": "3.1.5",
-    "@types/node": "24.13.3",
+    "@types/node": "24.13.2",
     "typescript": "5.9.3"
   }
 }