From f3a7cdbbef58d07cccf4d9777992f111270c45e1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 10:30:25 +0000 Subject: [PATCH 1/2] build: bump python from `86f975a` to `23c5939` in /docker Bumps python from `86f975a` to `23c5939`. --- updated-dependencies: - dependency-name: python dependency-version: 3.14-slim-bookworm dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- docker/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 287a7c6d..819a6c1a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -25,7 +25,7 @@ # docker-content-digest header, fetched 2026-07-27. # Refresh: Dependabot's `docker` ecosystem (.github/dependabot.yml) opens a # PR when the tag moves; do not hand-edit without re-fetching the header. -FROM python:3.14-slim-bookworm@sha256:86f975aca15cf04a40b399eebede9aea7c82eae084d1f1a0a6ef6bcaae871a30 AS builder +FROM python:3.14-slim-bookworm@sha256:23c59390fc717bf09f9336908199a0ae75d9c4264bf296123f94ad772fea3b52 AS builder # Node.js 22 LTS. # @@ -114,7 +114,7 @@ RUN for attempt in 1 2 3 4 5; do \ # ── Runtime ─────────────────────────────────────────────────────────────── -FROM python:3.14-slim-bookworm@sha256:86f975aca15cf04a40b399eebede9aea7c82eae084d1f1a0a6ef6bcaae871a30 +FROM python:3.14-slim-bookworm@sha256:23c59390fc717bf09f9336908199a0ae75d9c4264bf296123f94ad772fea3b52 # System: PostgreSQL 17 + pgvector + git + ripgrep RUN apt-get update && apt-get install -y --no-install-recommends \ From 7ebbaaf64c9787c8d8809fe6bfe5311768a9fb60 Mon Sep 17 00:00:00 2001 From: cdeust Date: Mon, 10 Aug 2026 16:16:43 +0200 Subject: [PATCH 2/2] fix(docker): correct source comment to python:3.14, not 3.12 The digest-verification comment above the FROM line named python:3.12-slim-bookworm while the actual pinned tag is 3.14-slim-bookworm (has been since the image moved off 3.12 per the runtime-stage COPY-path incident note lower in this file). Re-fetched the docker-content-digest header against the correct 3.14-slim-bookworm manifest and confirmed it matches the pinned sha unchanged. Co-Authored-By: Claude --- docker/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 819a6c1a..f5ce297a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -19,10 +19,10 @@ # ── Builder ─────────────────────────────────────────────────────────────── # Base image pinned by digest so a rebuild cannot silently pick up a -# different python:3.12-slim-bookworm. Digest resolved from the multi-arch manifest +# different python:3.14-slim-bookworm. Digest resolved from the multi-arch manifest # list, so it stays correct on both amd64 and arm64. -# source: registry-1.docker.io/v2/library/python/manifests/3.12-slim-bookworm, -# docker-content-digest header, fetched 2026-07-27. +# source: registry-1.docker.io/v2/library/python/manifests/3.14-slim-bookworm, +# docker-content-digest header, fetched 2026-08-10. # Refresh: Dependabot's `docker` ecosystem (.github/dependabot.yml) opens a # PR when the tag moves; do not hand-edit without re-fetching the header. FROM python:3.14-slim-bookworm@sha256:23c59390fc717bf09f9336908199a0ae75d9c4264bf296123f94ad772fea3b52 AS builder