chore(deps): update postgres docker tag to v18

[renovate]

This PR contains the following updates:

Package	Update	Change
postgres (source)	major	17 → 18

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anitrend]

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: CHANGES_REQUESTED
Risk: HIGH
Automerge allowed: false
Update type: semver-major
Ecosystem: docker

Summary

Renovate proposes upgrading postgres from 17 to 18 (semver major). Postgres is a stateful service and a major version bump requires a controlled data migration (pg_upgrade or dump/restore). The generated stack file stacks/infrastructure.yml is also modified, which is expected given the source compose change, but the migration itself is a manual, high-risk operation that cannot be automated.

Changed runtime artifacts

Image / dependency	From	To	Risk note
postgres	17	18	major version bump for stateful database service; requires pg_upgrade or dump/restore data migration; breaking runtime migration risk

Runtime impact

Cannot be rolled out as a simple rolling update. Requires planned downtime, backup verification, migration execution, and validation before the new image can serve traffic. The existing data volume with Postgres 17 data format is incompatible with the Postgres 18 server binary.

Breaking change assessment

Postgres major version upgrades are breaking by nature — they require database migration procedures (pg_upgrade, logical replication, or dump/restore) and may introduce incompatibilities in system catalogs, extensions, or replication slots. Release notes were not fetched, but the semver major tag alone signals breaking change for a stateful service.

Required checks

• Review Postgres 18 release notes for breaking changes and deprecated features
• Verify backup of all Postgres 17 databases exists
• Test pg_upgrade or logical replication on a staging environment first
• ./stackctl.sh sync
• ./stackctl.sh up --dry-run --no-logs

Manual follow-up

• Coordinate a maintenance window for the database migration
• Run pg_upgrade or dump/restore procedure on the production volume
• Validate all connected services (GrowthBook, Unleash, etc.) work with Postgres 18
• Update postgres/.env.example if any new configuration variables are required for v18

Sources checked

• Dependabot metadata
• PR diff
• PR title and body

[anitrend]

OpenCode risk gate: neutral. Manual review required. Risk: high. Reason: Renovate proposes upgrading postgres from major version 17 to 18. This is a semver-major update for a stateful service that requires data migration, breaking-change review, and manual merge. Both the source compose file and the generated stack are updated, which is consistent, but the major version bump for a database service demands human oversight.

[anitrend]

OpenCode risk gate: changes requested. Risk: high. Reason: Renovate proposes upgrading postgres from 17 to 18 (semver major). Postgres is a stateful service and a major version bump requires a controlled data migration (pg_upgrade or dump/restore). The generated stack file stacks/infrastructure.yml is also modified, which is expected given the source compose change, but the migration itself is a manual, high-risk operation that cannot be automated.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.