From 38e73e5ecb00cfbbe8eb7437770dfa0998637602 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 00:55:20 +0000
Subject: [PATCH 1/2] chore(deps): update bump-dependencies

---
 ci/config-management-cloud-smoke.sh                       | 2 +-
 ci/config-management-smoke.sh                             | 2 +-
 docs/Dockerfile                                           | 4 ++--
 rootfs/home/cloud-compose/install-dependencies-cos.sh     | 2 +-
 rootfs/mnt/disks/data/libops-internal/docker-compose.yaml | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ci/config-management-cloud-smoke.sh b/ci/config-management-cloud-smoke.sh
index 6d2ae86..bb2cc86 100755
--- a/ci/config-management-cloud-smoke.sh
+++ b/ci/config-management-cloud-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015"
 
 usage() {
   cat <<EOF
diff --git a/ci/config-management-smoke.sh b/ci/config-management-smoke.sh
index 42e356d..9d3fe6d 100755
--- a/ci/config-management-smoke.sh
+++ b/ci/config-management-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015"
 image="${CLOUD_COMPOSE_CONFIG_MANAGEMENT_IMAGE:-$CONFIG_MANAGEMENT_IMAGE_DEFAULT}"
 
 require_cmd() {
diff --git a/docs/Dockerfile b/docs/Dockerfile
index 5011d6f..f19dc39 100644
--- a/docs/Dockerfile
+++ b/docs/Dockerfile
@@ -3,8 +3,8 @@ FROM python:3.14-alpine3.22@sha256:6b91e66ab2a880ce9ca5a1b91c70f45963ff71ff68268
 WORKDIR /work
 
 RUN apk add --no-cache git && \
-    pip install uv==0.11.28 && \
-    uv pip install --break-system-packages --system zensical==0.0.46
+    pip install uv==0.11.29 && \
+    uv pip install --break-system-packages --system zensical==0.0.50
 
 EXPOSE 8080
 
diff --git a/rootfs/home/cloud-compose/install-dependencies-cos.sh b/rootfs/home/cloud-compose/install-dependencies-cos.sh
index 0f6320e..c1e27ff 100644
--- a/rootfs/home/cloud-compose/install-dependencies-cos.sh
+++ b/rootfs/home/cloud-compose/install-dependencies-cos.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 # renovate: datasource=docker depName=alpine packageName=alpine versioning=docker
-ALPINE_BUILD_IMAGE="alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"
+ALPINE_BUILD_IMAGE="alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
 MAKE_VERSION="4.4.1"
 
 valid_make_binary() {
diff --git a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
index bf01f6e..21579cc 100644
--- a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
+++ b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
@@ -40,7 +40,7 @@ services:
       - /mnt/disks/data/docker/:/var/lib/docker:ro
       - /dev/disk/:/dev/disk:ro
   cap:
-    image: ghcr.io/libops/cap:main@sha256:13959cc4c78dec2ffff0c4c45d05d85587d08dc50c0cc40cb6088c4ead381ad4
+    image: ghcr.io/libops/cap:main@sha256:c9d6a6c2ded2d0a72ceff382fd71da9cd161c17c071319b45270b07c0f54a5ed
     command: ["/app/binary"]
     networks:
       - internal

From daf235c91115b96163da56a14e3bf6ec122ba277 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Thu, 16 Jul 2026 01:31:06 +0000
Subject: [PATCH 2/2] [skip-release] Align dependency smoke environments

---
 ci/config-management-cloud-smoke.sh                  |  2 +-
 ci/config-management-smoke.sh                        |  2 +-
 ci/cos-bootstrap-contract.sh                         | 12 ++++++++++--
 docs/non-gcp-providers.md                            |  6 +++---
 .../home/cloud-compose/install-dependencies-cos.sh   |  2 +-
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/ci/config-management-cloud-smoke.sh b/ci/config-management-cloud-smoke.sh
index bb2cc86..6d2ae86 100755
--- a/ci/config-management-cloud-smoke.sh
+++ b/ci/config-management-cloud-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
 
 usage() {
   cat <<EOF
diff --git a/ci/config-management-smoke.sh b/ci/config-management-smoke.sh
index 9d3fe6d..42e356d 100755
--- a/ci/config-management-smoke.sh
+++ b/ci/config-management-smoke.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/.." && pwd)"
 # renovate: datasource=docker depName=python packageName=python versioning=docker
-CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015"
+CONFIG_MANAGEMENT_IMAGE_DEFAULT="python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3"
 image="${CLOUD_COMPOSE_CONFIG_MANAGEMENT_IMAGE:-$CONFIG_MANAGEMENT_IMAGE_DEFAULT}"
 
 require_cmd() {
diff --git a/ci/cos-bootstrap-contract.sh b/ci/cos-bootstrap-contract.sh
index 1b87b41..adf8219 100755
--- a/ci/cos-bootstrap-contract.sh
+++ b/ci/cos-bootstrap-contract.sh
@@ -17,10 +17,18 @@ mkdir -p "$BIN_DIR" "$CLOUD_HOME" "$DATA_DIR" "$DOCKER_CONFIG_DIR"
 
 # Static trust contract: the build environment is an immutable multi-platform
 # image, and the GNU Make archive is verified before any extraction occurs.
-if ! grep -Eq '^ALPINE_BUILD_IMAGE="alpine:3\.22@sha256:[0-9a-f]{64}"$' "$INSTALLER"; then
+if ! grep -Fqx 'ALPINE_BUILD_IMAGE="alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"' "$INSTALLER"; then
     echo "COS bootstrap Alpine image is not digest pinned" >&2
     exit 1
 fi
+grep -Fq '"${alpine_mirror}/v3.22/main"' "$INSTALLER" || {
+    echo "COS bootstrap Alpine main repository does not match the pinned image release" >&2
+    exit 1
+}
+grep -Fq '"${alpine_mirror}/v3.22/community"' "$INSTALLER" || {
+    echo "COS bootstrap Alpine community repository does not match the pinned image release" >&2
+    exit 1
+}
 # Assert the literal command in the bootstrap script.
 # shellcheck disable=SC2016
 if ! grep -Fq 'echo "${MAKE_SHA256}  /tmp/make.tar.gz" | sha256sum -c -' "$INSTALLER"; then
@@ -154,7 +162,7 @@ PATH="${BIN_DIR}:$PATH" \
 
 grep -Fq "plugin:${DOCKER_CONFIG_DIR}/cli-plugins:${CLOUD_HOME}/install-docker-plugins.sh" "$CALL_LOG"
 grep -Fq "plugin:${CLOUD_HOME}/.docker/cli-plugins:${CLOUD_HOME}/install-docker-plugins.sh" "$CALL_LOG"
-grep -Eq 'docker: .*alpine:3\.22@sha256:[0-9a-f]{64}' "$CALL_LOG"
+grep -Fq 'alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce' "$CALL_LOG"
 [[ -x "${DATA_DIR}/make" ]]
 "${DATA_DIR}/make" --version | grep -Fq 'GNU Make 4.4.1'
 [[ -f "${DATA_DIR}/make.state" ]]
diff --git a/docs/non-gcp-providers.md b/docs/non-gcp-providers.md
index ce271d3..40622f9 100644
--- a/docs/non-gcp-providers.md
+++ b/docs/non-gcp-providers.md
@@ -22,12 +22,12 @@ root retains its historical `module.gcp[0]` address and now loads only GCP-
 related providers. A GCP caller can move to `providers/gcp` later, but that is a
 separate state refactor and is not required to remove DigitalOcean or Linode.
 
-DigitalOcean and Linode callers must change the module source at 2.0.0 while
+DigitalOcean and Linode callers must change the module source at 1.3.0 while
 keeping the caller's module block name unchanged. For example:
 
 ```hcl
 module "site" {
-  source = "github.com/libops/cloud-compose//providers/do?ref=2.0.0"
+  source = "github.com/libops/cloud-compose//providers/do?ref=1.3.0"
 
   # Keep the existing name, template, digitalocean, and runtime values.
 }
@@ -42,7 +42,7 @@ The Linode equivalent is:
 
 ```hcl
 module "site" {
-  source = "github.com/libops/cloud-compose//providers/linode?ref=2.0.0"
+  source = "github.com/libops/cloud-compose//providers/linode?ref=1.3.0"
 
   # Keep the existing name, template, linode, and runtime values.
 }
diff --git a/rootfs/home/cloud-compose/install-dependencies-cos.sh b/rootfs/home/cloud-compose/install-dependencies-cos.sh
index c1e27ff..0f6320e 100644
--- a/rootfs/home/cloud-compose/install-dependencies-cos.sh
+++ b/rootfs/home/cloud-compose/install-dependencies-cos.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 # renovate: datasource=docker depName=alpine packageName=alpine versioning=docker
-ALPINE_BUILD_IMAGE="alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+ALPINE_BUILD_IMAGE="alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"
 MAKE_VERSION="4.4.1"
 
 valid_make_binary() {