docker: bump alpine from 3.23.4 to 3.24.1#601
Conversation
Bumps alpine from 3.23.4 to 3.24.1. --- updated-dependencies: - dependency-name: alpine dependency-version: 3.24.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
left a comment
bgentry
left a comment
There was a problem hiding this comment.
🤖 Codex review: Security review looks good to me.
I reviewed this as a dependency-upgrade supply-chain/security pass for the Alpine runtime image update at head 15376803ceacb67300c0c705c77bd72a75dc667b.
Scope reviewed:
DockerfileandDockerfile.profinal runtime image changes.- Official Docker Hub
library/alpinesource and pinned digest behavior. - Live Docker Hub manifest-list digest verification with
skopeo inspect --raw. - CI status, with the known Dependabot
riverprouiimage-publish/OIDC failure treated separately from dependency safety.
No blocking supply-chain issue found. The update keeps the image source on official Docker Hub library/alpine, remains digest-pinned, and changes only the final runtime base image from alpine:3.23.4@sha256:5b10f432... to alpine:3.24.1@sha256:28bd5fe8... in both Dockerfiles.
I independently verified that the current raw manifest-list digest for docker.io/library/alpine:3.24.1 is sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b, matching the PR.
The remaining failed riverproui image checks are consistent with the known Dependabot OIDC/publish limitation, while the ordinary JS/Go checks and riverui image jobs passed.
1 participant
Bumps alpine from 3.23.4 to 3.24.1.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)