docker: bump golang from 1.26.4-alpine to 1.26.4-alpine#605
Conversation
Bumps golang from 1.26.4-alpine to 1.26.4-alpine. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4-alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
left a comment
bgentry
left a comment
There was a problem hiding this comment.
🤖 Codex review: Security review looks good to me.
I reviewed this as a dependency-upgrade supply-chain/security pass for the dev golang:1.26.4-alpine image digest refresh at head d314444b0c11033cf0684781144ac3ec41800023.
Scope reviewed:
docker-compose.dev.yamlmigrate service image reference change.- Official Docker Hub
library/golangsource and pinned digest behavior. - Live Docker Hub manifest-list digest verification with
skopeo inspect --raw. - CI status, with the known Dependabot
riverprouiimage-publish/OIDC failure treated separately from dependency safety.
No blocking supply-chain issue found. The update keeps the image source on official Docker Hub library/golang, keeps the same 1.26.4-alpine tag, and only refreshes the pinned dev Compose digest from sha256:f23e8b2... to sha256:3ad5730....
I independently verified that the current raw manifest-list digest for docker.io/library/golang:1.26.4-alpine is sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648, matching the PR.
The remaining failed riverproui image checks are consistent with the known Dependabot OIDC/publish limitation, while the ordinary JS/Go checks and riverui image jobs passed.
1 participant
Bumps golang from 1.26.4-alpine to 1.26.4-alpine.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)