From ea2b0d5bbd8a4c170fb1f6619504516d51a69f6e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:56:30 +0000 Subject: [PATCH 1/2] chore(deps): Bump the docker-minor-patch group across 1 directory with 2 updates Bumps the docker-minor-patch group with 2 updates in the / directory: golang and alpine. Updates `golang` from 1.26.10-alpine3.24 to 1.27.2-alpine3.24 Updates `alpine` from 3.24.1 to 3.24.2 --- updated-dependencies: - dependency-name: alpine dependency-version: 3.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-minor-patch - dependency-name: golang dependency-version: 1.27.2-alpine3.24 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-minor-patch ... Signed-off-by: dependabot[bot] --- Dockerfile | 4 ++-- Dockerfile.dev | 2 +- Dockerfile.test | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9c3e42800..31848478e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ ARG TARGETOS=linux # To refresh: `docker buildx imagetools inspect golang:1.26.10-alpine3.24` # (or use the Docker Hub API tags endpoint) and update the digest below. # A Renovate / Dependabot config can automate this if desired. -FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder +FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS builder # Re-declare args for use in this stage ARG TARGETARCH @@ -131,7 +131,7 @@ RUN npm run build # To refresh: `docker buildx imagetools inspect alpine:3.24.1` and update the # digest below. This is the multi-arch index digest, not a per-platform one, so # it stays correct for every TARGETARCH this image is built for. -FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b +FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 # Re-declare args for use in this stage ARG TARGETARCH diff --git a/Dockerfile.dev b/Dockerfile.dev index c7605eb8f..c7d3faeaa 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -8,7 +8,7 @@ # golang-migrate binary below is built on it, and # internal/database/postgres/migrations/dockerfile_migrate_test.go fails when # the two drift. -FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS development +FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS development # Install development tools and Air for hot reload RUN apk add --no-cache \ diff --git a/Dockerfile.test b/Dockerfile.test index 2459119f2..63c0c6dd8 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -5,7 +5,7 @@ # # Base image pinned by digest for the same supply-chain reasons as Dockerfile; # keep the digest in sync with the builder stage there. -FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca +FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d # Run the suite as a non-root user (trivy DS-0002). tests/e2e is a stdlib-only # module so no module downloads are needed; GOCACHE lives in the user's home, From b89201d6f6b188ce4454097ba1013ce63492f061 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 26 Oct 2026 17:20:32 +0000 Subject: [PATCH 2/2] fix(docker): keep the Go builder on 1.26.10 and hold Go minor bumps The group bumped the golang images to 1.27.2, whose standard library carries GO-2026-6809 (crypto/x509 intermediate distrust, fixed in 1.26.10 and 1.27.3). The shipped-image scan in the "Build Docker Image" jobs correctly failed on both /app/cudly and /usr/local/bin/migrate. The build itself was fine; the go.mod/toolchain line was not involved. go.mod, go.work and ci.yml's GO_VERSION all pin Go 1.26.10, so CI tests on 1.26 while the image would have shipped a 1.27 build. Restore the golang:1.26.10 builder (main's digest) in Dockerfile, Dockerfile.dev and Dockerfile.test, and keep the alpine 3.24.1 -> 3.24.2 runtime bump. Add a Dependabot ignore for golang semver-minor in the docker ecosystem, so the next group run does not reopen a 1.27 image bump on its own. A Go 1.27 move should update go.mod, go.work, GO_VERSION and the three Dockerfiles together. Go 1.26.x patch releases still arrive. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 10 ++++++++++ Dockerfile | 4 ++-- Dockerfile.dev | 2 +- Dockerfile.test | 2 +- 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index eb71aa07c..febfe0216 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -97,6 +97,16 @@ updates: prefix: chore(deps) labels: - type/chore + # A new Go minor (1.26 -> 1.27) is a toolchain move, not a routine image + # bump: go.mod, go.work, ci.yml's GO_VERSION and these three Dockerfiles + # move together, so the image is built on the Go that CI tests. #1470 moved + # only the images, to golang 1.27.2, which also carried GO-2026-6809 + # (fixed in 1.26.10 and 1.27.3) and failed the shipped-image scan. Go + # patch releases (1.26.x) still arrive through the group below. + ignore: + - dependency-name: golang + update-types: + - version-update:semver-minor groups: docker-minor-patch: update-types: diff --git a/Dockerfile b/Dockerfile index 31848478e..195a3e3f3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ ARG TARGETOS=linux # To refresh: `docker buildx imagetools inspect golang:1.26.10-alpine3.24` # (or use the Docker Hub API tags endpoint) and update the digest below. # A Renovate / Dependabot config can automate this if desired. -FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder # Re-declare args for use in this stage ARG TARGETARCH @@ -128,7 +128,7 @@ RUN npm run build # Runtime stage - multi-arch base image # ============================================== # Image pinned to a SHA256 digest for reproducible builds. -# To refresh: `docker buildx imagetools inspect alpine:3.24.1` and update the +# To refresh: `docker buildx imagetools inspect alpine:3.24.2` and update the # digest below. This is the multi-arch index digest, not a per-platform one, so # it stays correct for every TARGETARCH this image is built for. FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 diff --git a/Dockerfile.dev b/Dockerfile.dev index c7d3faeaa..c7605eb8f 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -8,7 +8,7 @@ # golang-migrate binary below is built on it, and # internal/database/postgres/migrations/dockerfile_migrate_test.go fails when # the two drift. -FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS development +FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS development # Install development tools and Air for hot reload RUN apk add --no-cache \ diff --git a/Dockerfile.test b/Dockerfile.test index 63c0c6dd8..2459119f2 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -5,7 +5,7 @@ # # Base image pinned by digest for the same supply-chain reasons as Dockerfile; # keep the digest in sync with the builder stage there. -FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d +FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca # Run the suite as a non-root user (trivy DS-0002). tests/e2e is a stdlib-only # module so no module downloads are needed; GOCACHE lives in the user's home,