From 3b891fb7d1586931fa22568cbe777512d134d236 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 13:27:13 +0000 Subject: [PATCH 1/2] chore(deps): bump the docker-base-images group across 5 directories with 5 updates Bumps the docker-base-images group with 1 update in the /api directory: python. Bumps the docker-base-images group with 1 update in the /mcp directory: python. Bumps the docker-base-images group with 2 updates in the /operator directory: golang and distroless/static. Bumps the docker-base-images group with 2 updates in the /proxy directory: golang and distroless/static. Bumps the docker-base-images group with 2 updates in the /ui directory: node and nginx. Updates `python` from 3.14-slim to 3.15-slim Updates `python` from 3.14-slim to 3.15-slim Updates `golang` from `f241642` to `2920bb1` Updates `distroless/static` from `d620678` to `25ac8f0` Updates `golang` from `f241642` to `2920bb1` Updates `distroless/static` from `d620678` to `25ac8f0` Updates `node` from `44fce69` to `8a32c8c` Updates `nginx` from `892bb21` to `785835e` --- updated-dependencies: - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: docker-base-images - dependency-name: python dependency-version: 3.15-slim dependency-type: direct:production dependency-group: docker-base-images - dependency-name: golang dependency-version: 1.27.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-base-images - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-base-images - dependency-name: golang dependency-version: 1.27.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-base-images - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-base-images - dependency-name: node dependency-version: 24-alpine dependency-type: direct:production dependency-group: docker-base-images - dependency-name: nginx dependency-version: 1.31-alpine dependency-type: direct:production dependency-group: docker-base-images ... Signed-off-by: dependabot[bot] --- api/Dockerfile | 4 ++-- mcp/Dockerfile | 4 ++-- operator/Dockerfile | 4 ++-- proxy/Dockerfile | 4 ++-- ui/Dockerfile | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/api/Dockerfile b/api/Dockerfile index 73747fa..a0d14ba 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -1,5 +1,5 @@ # Python version comes from api/.python-version (CI checks they agree). -FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS builder +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS builder # Install exactly what uv.lock pins: no resolution at build time. COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv @@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project COPY src/ src/ RUN uv sync --frozen --no-dev --no-editable -FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 # The app runs from /app/.venv; the base image's pip (and the packages it # vendors) is never used at runtime, so it is removed rather than shipped. RUN useradd --uid 65532 --user-group --no-create-home app \ diff --git a/mcp/Dockerfile b/mcp/Dockerfile index b85381c..cea0cd7 100644 --- a/mcp/Dockerfile +++ b/mcp/Dockerfile @@ -1,5 +1,5 @@ # Python version comes from mcp/.python-version (CI checks they agree). -FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS builder +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS builder # Install exactly what uv.lock pins: no resolution at build time. COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv @@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project COPY src/ src/ RUN uv sync --frozen --no-dev --no-editable -FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 # The app runs from /app/.venv; the base image's pip (and the packages it # vendors) is never used at runtime, so it is removed rather than shipped. RUN useradd --uid 65532 --user-group --no-create-home app \ diff --git a/operator/Dockerfile b/operator/Dockerfile index c35612e..90badc7 100644 --- a/operator/Dockerfile +++ b/operator/Dockerfile @@ -1,7 +1,7 @@ # The builder runs natively and cross-compiles (GOARCH below), instead of # running the whole Go toolchain under emulation for non-native platforms. # Go version matches the toolchain line in go.mod (CI checks they agree). -FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:f24164268fc1e741bbdc0066dbadcf1c8426c5a8489f0729c02c3905a53032fd AS builder +FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS builder ARG TARGETOS=linux ARG TARGETARCH @@ -16,7 +16,7 @@ COPY internal/ internal/ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ go build -a -o apps-operator ./cmd -FROM gcr.io/distroless/static:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88 +FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329 WORKDIR / COPY --from=builder /workspace/apps-operator . USER 65532:65532 diff --git a/proxy/Dockerfile b/proxy/Dockerfile index f89dbb9..fa5187e 100644 --- a/proxy/Dockerfile +++ b/proxy/Dockerfile @@ -1,7 +1,7 @@ # The builder runs natively and cross-compiles (GOARCH below), instead of # running the whole Go toolchain under emulation for non-native platforms. # Go version matches the toolchain line in go.mod (CI checks they agree). -FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:f24164268fc1e741bbdc0066dbadcf1c8426c5a8489f0729c02c3905a53032fd AS builder +FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS builder ARG TARGETOS=linux ARG TARGETARCH @@ -15,7 +15,7 @@ COPY internal/ internal/ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ go build -trimpath -ldflags="-s -w" -o apps-proxy . -FROM gcr.io/distroless/static:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88 +FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329 WORKDIR / COPY --from=builder /workspace/apps-proxy . USER 65532:65532 diff --git a/ui/Dockerfile b/ui/Dockerfile index 621e3ee..c574d58 100644 --- a/ui/Dockerfile +++ b/ui/Dockerfile @@ -1,5 +1,5 @@ # Node major comes from ui/.node-version (CI checks they agree). -FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS builder +FROM node:24-alpine@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85 AS builder WORKDIR /app COPY package*.json ./ @@ -8,7 +8,7 @@ RUN npm ci COPY ./ ./ RUN npm run build -FROM nginx:1.31-alpine@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d +FROM nginx:1.31-alpine@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606 # envsubst (gettext) renders ${API_URL} into the config at startup; jq powers # the entrypoint's optional BRANDING_* overlay (standalone runs only). From 55a8f2ae83b8b92b51cd7e2957c94a9a0a6faee2 Mon Sep 17 00:00:00 2001 From: jbouder <61591423+jbouder@users.noreply.github.com> Date: Sun, 1 Nov 2026 14:51:22 +0000 Subject: [PATCH 2/2] Keep Python base images on 3.14 Revert the python:3.15-slim bump so the images match api/.python-version and mcp/.python-version, refreshing to the latest 3.14-slim digest. Add a version-based Dependabot ignore since the update-types rule did not stop the 3.14-slim -> 3.15-slim tag bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 4 ++++ api/Dockerfile | 4 ++-- mcp/Dockerfile | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a542cef..0dc8899 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -131,6 +131,10 @@ updates: # together on purpose. Patch and digest updates still flow through. - dependency-name: "python" update-types: ["version-update:semver-major", "version-update:semver-minor"] + # Tags like "3.14-slim" slip past update-types, so also cap by version. + # Raise this together with the .python-version files. + - dependency-name: "python" + versions: [">=3.15"] schedule: interval: "monthly" day: "monday" diff --git a/api/Dockerfile b/api/Dockerfile index a0d14ba..43cfd61 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -1,5 +1,5 @@ # Python version comes from api/.python-version (CI checks they agree). -FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS builder +FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 AS builder # Install exactly what uv.lock pins: no resolution at build time. COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv @@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project COPY src/ src/ RUN uv sync --frozen --no-dev --no-editable -FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 +FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 # The app runs from /app/.venv; the base image's pip (and the packages it # vendors) is never used at runtime, so it is removed rather than shipped. RUN useradd --uid 65532 --user-group --no-create-home app \ diff --git a/mcp/Dockerfile b/mcp/Dockerfile index cea0cd7..525e346 100644 --- a/mcp/Dockerfile +++ b/mcp/Dockerfile @@ -1,5 +1,5 @@ # Python version comes from mcp/.python-version (CI checks they agree). -FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS builder +FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 AS builder # Install exactly what uv.lock pins: no resolution at build time. COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv @@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project COPY src/ src/ RUN uv sync --frozen --no-dev --no-editable -FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 +FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 # The app runs from /app/.venv; the base image's pip (and the packages it # vendors) is never used at runtime, so it is removed rather than shipped. RUN useradd --uid 65532 --user-group --no-create-home app \