From a86f7d5d1012a4597bb1a3dfd2201ffce0d49c65 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 17:45:26 +0000 Subject: [PATCH] build(deps): Bump the docker-images group across 4 directories with 5 updates Bumps the docker-images group with 3 updates in the /crates/registry-relay directory: rust, distroless/cc-debian12 and debian. Bumps the docker-images group with 2 updates in the /products/notary directory: rust and distroless/cc-debian12. Bumps the docker-images group with 2 updates in the /release/conformance/openid directory: nginx and eclipse-temurin. Bumps the docker-images group with 2 updates in the /release/docker directory: distroless/cc-debian12 and debian. Updates `rust` from `6258907` to `8fa55b2` Updates `distroless/cc-debian12` from `bd2899c` to `66aa873` Updates `debian` from `0104b33` to `7b140f3` Updates `rust` from `54152db` to `8fa55b2` Updates `distroless/cc-debian12` from `b0ae8e9` to `66aa873` Updates `nginx` from 1.27.3 to 1.31.3 Updates `eclipse-temurin` from 21 to 25 Updates `distroless/cc-debian12` from `ce0d66b` to `66aa873` Updates `debian` from `60eac75` to `7b140f3` --- updated-dependencies: - dependency-name: rust dependency-version: 1-bookworm dependency-type: direct:production dependency-group: docker-images - dependency-name: distroless/cc-debian12 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-images - dependency-name: debian dependency-version: bookworm-slim dependency-type: direct:production dependency-group: docker-images - dependency-name: rust dependency-version: 1-bookworm dependency-type: direct:production dependency-group: docker-images - dependency-name: distroless/cc-debian12 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-images - dependency-name: nginx dependency-version: 1.31.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-images - dependency-name: eclipse-temurin dependency-version: '25' dependency-type: direct:production update-type: version-update:semver-major dependency-group: docker-images - dependency-name: distroless/cc-debian12 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-images - dependency-name: debian dependency-version: bookworm-slim dependency-type: direct:production dependency-group: docker-images ... Signed-off-by: dependabot[bot] --- crates/registry-relay/Dockerfile | 4 ++-- crates/registry-relay/Dockerfile.demo | 4 ++-- products/notary/Dockerfile | 4 ++-- release/conformance/openid/nginx.Dockerfile | 2 +- release/conformance/openid/server-dev.Dockerfile | 2 +- release/docker/Dockerfile.registry-notary | 2 +- release/docker/Dockerfile.registry-relay | 4 ++-- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/crates/registry-relay/Dockerfile b/crates/registry-relay/Dockerfile index 5f6cb6bbc..9b3140cc9 100644 --- a/crates/registry-relay/Dockerfile +++ b/crates/registry-relay/Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1.7 # Keep the tag for humans and the digest for reproducible pulls. -FROM rust:1-bookworm@sha256:6258907abe69656e41cd992e0b705cdcfabcbbe3db374f92ed2d47121282d4a1 AS builder +FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder WORKDIR /workspace/registry_relay COPY Cargo.toml Cargo.lock ./ @@ -34,7 +34,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \ chown -R 65532:65532 /workspace/runtime-root # Distroless cc keeps glibc and CA certificates while dropping shell/package tools. -FROM gcr.io/distroless/cc-debian12:nonroot@sha256:bd2899c12b335c827750ccf2359879eab09c09b206023dcebea408947d54127c AS runtime +FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ / COPY --from=builder /usr/local/bin/registry-relay /usr/local/bin/registry-relay diff --git a/crates/registry-relay/Dockerfile.demo b/crates/registry-relay/Dockerfile.demo index 613029f45..495e17122 100644 --- a/crates/registry-relay/Dockerfile.demo +++ b/crates/registry-relay/Dockerfile.demo @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1.7 # Keep the tag for humans and the digest for reproducible pulls. -FROM rust:1-bookworm@sha256:6258907abe69656e41cd992e0b705cdcfabcbbe3db374f92ed2d47121282d4a1 AS builder +FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder WORKDIR /workspace/registry_relay COPY Cargo.toml Cargo.lock ./ @@ -17,7 +17,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \ cp /workspace/registry_relay/target/release/registry-relay /usr/local/bin/registry-relay && \ cp /workspace/registry_relay/target/release/registry-relay-rhai-worker /usr/local/bin/registry-relay-rhai-worker -FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS runtime +FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime RUN groupadd --system --gid 10001 registry_relay && \ useradd --system --uid 10001 --gid registry_relay --home-dir /var/lib/registry-relay --shell /usr/sbin/nologin registry_relay && \ diff --git a/products/notary/Dockerfile b/products/notary/Dockerfile index 282074cae..01a3342bc 100644 --- a/products/notary/Dockerfile +++ b/products/notary/Dockerfile @@ -3,7 +3,7 @@ # syntax=docker/dockerfile:1.7 # Keep the tag for humans and the digest for reproducible pulls. -FROM rust:1-bookworm@sha256:54152db00aafd37bc5ce1f3585aaa42f17cdd5c8e5ef9eabfbc0718b42bce312 AS builder +FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder WORKDIR /workspace/registry-notary COPY --from=registry-platform Cargo.toml README.md LICENSE /workspace/registry-platform/ @@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \ # Runtime policy: the main Notary image is a distroless Rust service image. # Keep the runtime shell-free, non-root, and compatible with binary healthchecks # and JSON-array entrypoints. CI enforces this policy. -FROM gcr.io/distroless/cc-debian12:nonroot@sha256:b0ae8e989418b458e0f25489bc3be523718938a2b70864cc0f6a00af1ddbd985 AS runtime +FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime COPY --from=builder /workspace/out/ /usr/local/bin/ diff --git a/release/conformance/openid/nginx.Dockerfile b/release/conformance/openid/nginx.Dockerfile index 92491a193..f39367194 100644 --- a/release/conformance/openid/nginx.Dockerfile +++ b/release/conformance/openid/nginx.Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.27.3@sha256:bc2f6a7c8ddbccf55bdb19659ce3b0a92ca6559e86d42677a5a02ef6bda2fcef +FROM nginx:1.31.3@sha256:5a88c9c45479443d7be2eadc894b4ed0a9801bae03d97a5760ae13b5c2005942 RUN openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ -keyout /etc/ssl/private/nginx-selfsigned.key \ diff --git a/release/conformance/openid/server-dev.Dockerfile b/release/conformance/openid/server-dev.Dockerfile index 6f2de45ee..5a6726ac4 100644 --- a/release/conformance/openid/server-dev.Dockerfile +++ b/release/conformance/openid/server-dev.Dockerfile @@ -1,5 +1,5 @@ # Mirrors the pinned suite's development server image while fixing its base. -FROM eclipse-temurin:21@sha256:da9d3a4f7650db39b918fc5a2c3da76556fb8cc8e5f3767cdea0bb409286951a +FROM eclipse-temurin:25@sha256:201fbb8886b2d273218aa3a192f0afbf7b5ff65ee8cc6ef47f5dce2171f013ea RUN apt-get update \ && apt-get install -y --no-install-recommends redir=3.3-1build1 \ diff --git a/release/docker/Dockerfile.registry-notary b/release/docker/Dockerfile.registry-notary index 31c9f04ce..f6e596af2 100644 --- a/release/docker/Dockerfile.registry-notary +++ b/release/docker/Dockerfile.registry-notary @@ -2,7 +2,7 @@ # syntax=docker/dockerfile:1.7 -FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime +FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates \ diff --git a/release/docker/Dockerfile.registry-relay b/release/docker/Dockerfile.registry-relay index aba6caa85..9198b8c8f 100644 --- a/release/docker/Dockerfile.registry-relay +++ b/release/docker/Dockerfile.registry-relay @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime-root +FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime-root RUN mkdir -p \ /workspace/runtime-root/etc/registry-relay \ @@ -9,7 +9,7 @@ RUN mkdir -p \ /workspace/runtime-root/var/log/registry-relay && \ chown -R 65532:65532 /workspace/runtime-root -FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151 AS runtime +FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime COPY --from=runtime-root --chown=65532:65532 /workspace/runtime-root/ / COPY --chmod=0755 dist/image-bin/registry-relay /usr/local/bin/registry-relay