Bump the images group across 8 directories with 3 updates

libs/agent/Dockerfile

@@ -1,7 +1,7 @@
 # Build context is `libs/`, not `libs/agent/`; see the note in gateway/Dockerfile. The agent requires
 # libs/packages/tunnel through a `replace`, and a path outside the context does not exist to the
 # builder.
-FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build
+FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS build
 WORKDIR /src
 
 COPY packages/tunnel/ ./packages/tunnel/

libs/benchmarking/images/evalscope/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12.16-slim@sha256:f3aa44c1f89302501f8b812a3abe4ca997177f227e295d9a76ac0d683b493800
+FROM python:3.15.0-slim@sha256:f5b92f2a669a4c347044f29367f31983280b648250ca94dea66f98c53bc87e58
 
 RUN pip install --no-cache-dir \
       "evalscope==1.11.1" \

libs/benchmarking/images/vllm-bench/Dockerfile

@@ -1,6 +1,6 @@
 # Base pinned by digest and every package pinned in requirements.txt, so a rebuild of
 # one tag produces the same client. Same Python as libs/plane.
-FROM python:3.12.8-slim-bookworm@sha256:2199a62885a12290dc9c5be3ca0681d367576ab7bf037da120e564723292a2f0
+FROM python:3.15.0-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d
 
 COPY requirements.txt /tmp/requirements.txt
 RUN pip install --no-cache-dir -r /tmp/requirements.txt

libs/conformance/Dockerfile

@@ -9,7 +9,7 @@
 # profile outside the package is given by path; mount it too.
 #
 # Base pinned by digest, same Python as libs/plane and the vllm-bench image.
-FROM python:3.12.8-slim-bookworm@sha256:2199a62885a12290dc9c5be3ca0681d367576ab7bf037da120e564723292a2f0
+FROM python:3.15.0-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d
 
 RUN pip install --no-cache-dir uv==0.9.18
 

libs/console/Dockerfile

@@ -13,7 +13,7 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
 COPY . .
 RUN pnpm run build
 
-FROM nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
+FROM nginx:1.31.0-alpine@sha256:2f07d83bf561b506400dc183b1b2003803e39efbd22451f848adaba14d28c7c7
 
 # Nothing about the plane is baked into the bundle. 40-wingsmith-config.sh writes config.js and the
 # CSP from these at container start, so one image serves any plane. An empty base URL means the

libs/gateway/Dockerfile

@@ -4,7 +4,7 @@
 # path outside the context does not exist as far as the builder is concerned: the narrower context
 # fails at `go mod download` with a missing replacement, not anywhere informative. So the
 # context is the parent and both module trees are copied in.
-FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build
+FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS build
 WORKDIR /src
 
 # The wire first and on its own layer: it changes far less often than the gateway does, so a gateway

libs/operator/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build
+FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS build
 WORKDIR /src
 
 COPY go.mod go.sum ./

libs/plane/Dockerfile

@@ -7,7 +7,7 @@
 # that runs the console dev server, wants.
 ARG CONSOLE=bundled
 
-FROM python:3.12.8-slim-bookworm@sha256:2199a62885a12290dc9c5be3ca0681d367576ab7bf037da120e564723292a2f0 AS console-none
+FROM python:3.15.0-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d AS console-none
 RUN mkdir -p /src/dist
 
 FROM node:22.19.0-bookworm-slim@sha256:4a4884e8a44826194dff92ba316264f392056cbe243dcc9fd3551e71cea02b90 AS console-bundled
@@ -36,7 +36,7 @@ RUN pnpm run build
 
 FROM console-${CONSOLE} AS console
 
-FROM python:3.12.8-slim-bookworm@sha256:2199a62885a12290dc9c5be3ca0681d367576ab7bf037da120e564723292a2f0 AS build
+FROM python:3.15.0-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d AS build
 COPY --from=ghcr.io/astral-sh/uv:0.9.5@sha256:f459f6f73a8c4ef5d69f4e6fbbdb8af751d6fa40ec34b39a1ab469acd6e289b7 /uv /uvx /bin/
 WORKDIR /src
 
@@ -58,7 +58,7 @@ COPY plane/README.md ./
 COPY packages/contract/devices.json ./contract/devices.json
 RUN uv sync --locked --no-dev
 
-FROM python:3.12.8-slim-bookworm@sha256:2199a62885a12290dc9c5be3ca0681d367576ab7bf037da120e564723292a2f0
+FROM python:3.15.0-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d
 
 # psycopg is the pure-Python build and loads libpq at import time. A developer's machine has one
 # already, which is why this is missing, not wrong: the image had never been run. Installing