security - patch Go, CA and x/text/x/image advisories (23 Oct 2026)

.github/workflows/gofmt.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.26.3]
+        go-version: [1.26.10]
 
     steps:
       - name: Checkout code

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.26.3]
+        go-version: [1.26.10]
 
     steps:
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6

database/connection_test.go

@@ -37,7 +37,7 @@ func setupPostgresConnection(t *testing.T, models ...interface{}) (*database.Con
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pg, err := postgres.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgres.WithDatabase("testdb"),
 		postgres.WithUsername("test"),
 		postgres.WithPassword("secret"),

database/seeder/importer/runner_test.go

@@ -712,7 +712,7 @@ func setupPostgresConnection(t *testing.T) (*database.Connection, *env.Environme
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pg, err := postgres.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgres.WithDatabase("testdb"),
 		postgres.WithUsername("test"),
 		postgres.WithPassword("secret"),

database/seeder/seeds/seeder_test.go

@@ -26,7 +26,7 @@ func testConnection(t *testing.T, e *env.Environment) *database.Connection {
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pg, err := postgres.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgres.WithDatabase("testdb"),
 		postgres.WithUsername("test"),
 		postgres.WithPassword("secret"),

docker-compose.yml

@@ -344,7 +344,7 @@ services:
             dockerfile: ./infra/docker/dockerfile-api
             target: builder
             args:
-              - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.3-alpine3.23-r4}
+              - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.10-alpine3.23-r7}
           volumes:
             - .:/app
             - go_mod_cache:/go/pkg/mod
@@ -357,7 +357,7 @@ services:
               GOPATH: /go
               GOMODCACHE: /go/pkg/mod
               GOCACHE: /tmp/go-build
-              GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.3}
+              GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.10}
               ENV_DB_HOST: api-db
               ENV_SPA_DIR: ${ENV_SPA_DIR}
               ENV_DB_PORT: ${ENV_DB_PORT:-5432}
@@ -386,7 +386,7 @@ services:
               - ${API_LOGS_PATH:-./storage/logs/api}:/app/storage/logs
             environment:
                 CGO_ENABLED: 1
-                GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.3}
+                GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.10}
                 # --- This ensures the Go web server listens for connections from other
                 #     containers (like Caddy), not just from within itself.
                 ENV_APP_LOGS_DIR: /app/storage/logs/logs_%s.log
@@ -396,7 +396,7 @@ services:
                 context: .
                 dockerfile: ./infra/docker/dockerfile-api
                 args:
-                    - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.3-alpine3.23-r4}
+                    - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.10-alpine3.23-r7}
                     - APP_VERSION=0.0.0.1
                     - APP_HOST_PORT=${ENV_HTTP_PORT}
                     - APP_USER=${ENV_DOCKER_USER}
@@ -464,7 +464,7 @@ services:
             # Pinning to postgres:18.4-alpine to avoid CVE-2025-12817/12818 and ensure
             # consistent checksum behaviour (initdb enables checksums by default in PG 18).
             # This matches the version used in test environments for consistency.
-            image: postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88
+            image: postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
             container_name: oullin_db
 
             env_file:

go.mod

@@ -1,6 +1,6 @@
 module github.com/oullin
 
-go 1.26.3
+go 1.26.10
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2
@@ -18,9 +18,9 @@ require (
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
 	golang.org/x/crypto v0.52.0
-	golang.org/x/image v0.41.0
+	golang.org/x/image v0.45.0
 	golang.org/x/term v0.43.0
-	golang.org/x/text v0.37.0
+	golang.org/x/text v0.41.0
 	gopkg.in/yaml.v3 v3.0.1 // Application code uses v3; Prometheus uses v2 (go.yaml.in/yaml/v2) internally - both versions coexist safely
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/gorm v1.31.1
@@ -86,8 +86,8 @@ require (
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect; Required by prometheus/client_golang; no type conflicts with our gopkg.in/yaml.v3 usage
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
 

go.sum

@@ -194,18 +194,26 @@ golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
 golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
 golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/docker/base-images/Dockerfile.builder

@@ -7,9 +7,9 @@
 # against committed SHA256 checksums, and installed via an ephemeral RSA-signed
 # APKINDEX so `apk add` never contacts the live Alpine package index.
 
-ARG GO_VERSION=1.26.3
+ARG GO_VERSION=1.26.10
 ARG GO_IMAGE_VARIANT=alpine3.23
-ARG GO_IMAGE_DIGEST=sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d
+ARG GO_IMAGE_DIGEST=sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e
 
 FROM golang:${GO_VERSION}-${GO_IMAGE_VARIANT}@${GO_IMAGE_DIGEST}
 
@@ -75,11 +75,11 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \
         make-4.4.1-r3.apk \
         mpc1-1.3.1-r1.apk \
         mpfr4-4.2.2-r0.apk \
-        musl-1.2.5-r23.apk \
-        musl-dev-1.2.5-r23.apk \
+        musl-1.2.5-r24.apk \
+        musl-dev-1.2.5-r24.apk \
         patch-2.8-r0.apk \
         pkgconf-2.5.1-r0.apk \
-        zlib-1.3.2-r0.apk \
+        zlib-1.3.2-r1.apk \
         zstd-libs-1.5.7-r2.apk \
     ; do \
         wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \

infra/docker/base-images/Dockerfile.runtime

@@ -8,7 +8,7 @@
 # SHA256 checksum verification, ephemeral RSA-signed APKINDEX.
 
 ARG ALPINE_VERSION=3.23
-ARG ALPINE_IMAGE_DIGEST=sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
+ARG ALPINE_IMAGE_DIGEST=sha256:21f3e19bafab57a9ff7aa9dd571dac72f868370472c10f450cc0416cc1aca553
 
 FROM alpine:${ALPINE_VERSION}@${ALPINE_IMAGE_DIGEST}
 
@@ -47,9 +47,9 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \
     for apk_pkg in \
         libsharpyuv-1.6.0-r0.apk \
         libwebp-1.6.0-r0.apk \
-        musl-1.2.5-r23.apk \
-        tzdata-2026d-r0.apk \
-        zlib-1.3.2-r0.apk \
+        musl-1.2.5-r24.apk \
+        tzdata-2026e-r0.apk \
+        zlib-1.3.2-r1.apk \
     ; do \
         wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \
     done && \
@@ -67,7 +67,7 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \
         | gzip -9 \
         | cat - /tmp/APKINDEX.unsigned.tar.gz \
         > "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && \
-    apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r23 libwebp && \
-    apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026d-r0.apk" && \
+    apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r24 libwebp && \
+    apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026e-r0.apk" && \
     apk del --no-cache openssl && \
     rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub

infra/docker/base-images/checksums/builder-aarch64.sha256

@@ -21,9 +21,9 @@ e9a504ac218c00fa5c1fc83c7d5b94a3d26e2c2314404b3d101b22710bf752ec  libwebpmux-1.6
 e15217cadc367b7fc52871e3cc82fe7193bc82f75087db0598aa2e5e941f734c  make-4.4.1-r3.apk
 753858c93308a54fd2c578e67ce5f3947e4b7946052b1e66a892cd5ee7efd4a4  mpc1-1.3.1-r1.apk
 da8b196bad532b4a82ea62f0b1609fc4bbdadb8ac9fed7c7792a84be8084a04f  mpfr4-4.2.2-r0.apk
-6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e  musl-1.2.5-r23.apk
-19032a762b8c6967d3789de1bf540754a0121e517402022eebd3ae6f1c9965a4  musl-dev-1.2.5-r23.apk
+d7043c549029c98d438e9bc94213b006e5c88540eb58d1f5b0f0d1d56dbf9c98  musl-1.2.5-r24.apk
+8e3a2e5b78069ebd1307cb092972de2f95deb0b21b866a788d1ac7d6972db43e  musl-dev-1.2.5-r24.apk
 ed4ec83a16470de9087e295f53d3b2e1a666a684cc117ea017adb969ba044c4b  patch-2.8-r0.apk
 68a8cbd9901184caf0c4cf86c54ae199eae6110c313457ad34adb8ce1d929816  pkgconf-2.5.1-r0.apk
-ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8  zlib-1.3.2-r0.apk
+82d52fa82a46c73aae8b9f95d7f31a196137f3ce4a000980cdbbfc05c245e7bf  zlib-1.3.2-r1.apk
 50a998e56e4bf31504996e49c1b4a23eed5e0cd4e24b8a1356a54daf1a6eabbe  zstd-libs-1.5.7-r2.apk

infra/docker/base-images/checksums/builder-x86_64.sha256

@@ -21,9 +21,9 @@ ac19a7d33d4e7d4e14a6d6ca9481d3291eb7ef37759d9dc9226ccb47d3c752eb  libwebpmux-1.6
 db47019dc9ebbfec1c0224efb8c30b3e26f22728b6f433b492af57da622787d5  make-4.4.1-r3.apk
 114dcb18a4e5c7739fdab19414e156295c2783d56cdd226bcee4b5afc6a88c76  mpc1-1.3.1-r1.apk
 4361c9084ae95e3987cee87fed35bbaca10c75907eb1900365707196d250bdc8  mpfr4-4.2.2-r0.apk
-4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d  musl-1.2.5-r23.apk
-2ea566b665ebaea4f84cee1e4b7ef093b0aa67356006e84deb26d9bd7a716c6b  musl-dev-1.2.5-r23.apk
+d49d703392f1a6d2fe822db1b57e61735063077e1ad846d5f40d79fe507ec727  musl-1.2.5-r24.apk
+9a45a27051991319c020abd2e4f300f01b85febd745634d9e71cdbf133363448  musl-dev-1.2.5-r24.apk
 e7104a7dd5c4a8a0e4a1df2ff8ff0fd9a1587d8de791dffc18d8dae1c0e7ec3f  patch-2.8-r0.apk
 01244a680c1db46539f7e6160ba56476a18f53aefb86cc18354c8d283b6dda71  pkgconf-2.5.1-r0.apk
-f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56  zlib-1.3.2-r0.apk
+ee62e1864c235901e2aa4d1868c7ae8f7cc5d0740a98c48a2525332eb4bfda73  zlib-1.3.2-r1.apk
 d5fcc58f7f071a5658d97b09838668e4443203217631992915b8e60656904104  zstd-libs-1.5.7-r2.apk

infra/docker/base-images/checksums/runtime-aarch64.sha256

@@ -1,5 +1,5 @@
 5b5009c66c47bd7a49a1b0eb236b526a14b2ed6c0802cb82d41eb6f9ea852a59  libsharpyuv-1.6.0-r0.apk
 808eac0eba50a5a7de86e280f4337281eace15a6b10301ee04de3d39f212cfb9  libwebp-1.6.0-r0.apk
-6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e  musl-1.2.5-r23.apk
-b9421d401a00c7d88503bd22646a5d09df7ba7e34949a5cc009e54de93a1e25f  tzdata-2026d-r0.apk
-ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8  zlib-1.3.2-r0.apk
+d7043c549029c98d438e9bc94213b006e5c88540eb58d1f5b0f0d1d56dbf9c98  musl-1.2.5-r24.apk
+011514b53806fd660507958aaa28af8b896060bc10c4c4507fab1a13fff37da0  tzdata-2026e-r0.apk
+82d52fa82a46c73aae8b9f95d7f31a196137f3ce4a000980cdbbfc05c245e7bf  zlib-1.3.2-r1.apk

infra/docker/base-images/checksums/runtime-x86_64.sha256

@@ -1,5 +1,5 @@
 68b1787f41c36e7b6d9def855c5663f2f1ab62fbcc599d38ce3487e75fc883ec  libsharpyuv-1.6.0-r0.apk
 4d5303958ee38a978501c330c23b62ef98993ae3c30afcd62444723f33da2477  libwebp-1.6.0-r0.apk
-4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d  musl-1.2.5-r23.apk
-4967fbaa3919df716ec7a21c2a0465479425b34a99d5165b80fc3d677ed34ee8  tzdata-2026d-r0.apk
-f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56  zlib-1.3.2-r0.apk
+d49d703392f1a6d2fe822db1b57e61735063077e1ad846d5f40d79fe507ec727  musl-1.2.5-r24.apk
+b317a4fa0a6ce0bc9f2a62349e205ed9faf5c89cb80c817fdc9cedca53e78da1  tzdata-2026e-r0.apk
+ee62e1864c235901e2aa4d1868c7ae8f7cc5d0740a98c48a2525332eb4bfda73  zlib-1.3.2-r1.apk

infra/docker/base-images/generate-checksums.sh

@@ -45,20 +45,20 @@ BUILDER_PACKAGES=(
     make-4.4.1-r3.apk
     mpc1-1.3.1-r1.apk
     mpfr4-4.2.2-r0.apk
-    musl-1.2.5-r23.apk
-    musl-dev-1.2.5-r23.apk
+    musl-1.2.5-r24.apk
+    musl-dev-1.2.5-r24.apk
     patch-2.8-r0.apk
     pkgconf-2.5.1-r0.apk
-    zlib-1.3.2-r0.apk
+    zlib-1.3.2-r1.apk
     zstd-libs-1.5.7-r2.apk
 )
 
 RUNTIME_PACKAGES=(
     libsharpyuv-1.6.0-r0.apk
     libwebp-1.6.0-r0.apk
-    musl-1.2.5-r23.apk
-    tzdata-2026d-r0.apk
-    zlib-1.3.2-r0.apk
+    musl-1.2.5-r24.apk
+    tzdata-2026e-r0.apk
+    zlib-1.3.2-r1.apk
 )
 
 # Architectures for which we generate checksums (multi-platform support).

infra/docker/dockerfile-api

@@ -32,10 +32,10 @@ ARG BINARY_NAME=oullin_api
 # can work without registry access. CI/maintainers can override these args with
 # digest-pinned registry references after running `make push-base-images`.
 #
-ARG BASE_IMAGE_VERSION=1.26.3-alpine3.23-r4
+ARG BASE_IMAGE_VERSION=1.26.10-alpine3.23-r7
 ARG BUILDER_BASE_IMAGE=oullin-api-builder-base:${BASE_IMAGE_VERSION}
 ARG RUNTIME_BASE_IMAGE=oullin-api-runtime-base:${BASE_IMAGE_VERSION}
-ARG GO_TOOLCHAIN=go1.26.3
+ARG GO_TOOLCHAIN=go1.26.10
 
 # Non-root user/group settings.
 ARG APP_USER=appuser

infra/makefile/app.mk

@@ -11,7 +11,7 @@ DB_SECRETS_DIR      := $(ROOT_PATH)/database/infra/secrets
 
 # "auto" lets the local Go installation download the toolchain required by go.mod,
 # so developers don't need to install the exact Go version manually.
-# Override with a pinned version (e.g., GO_LOCAL_TOOLCHAIN=go1.26.3) for deterministic builds.
+# Override with a pinned version (e.g., GO_LOCAL_TOOLCHAIN=go1.26.10) for deterministic builds.
 # Note: docker-compose reads GO_LOCAL_TOOLCHAIN from the environment separately.
 GO_LOCAL_TOOLCHAIN  ?= auto
 GOIMPORTS_VERSION   ?= v0.43.0

infra/makefile/build.mk

@@ -1,12 +1,12 @@
 .PHONY: build-local watch-local build-ci build-prod build-release build-deploy build-local-restart build-prod-force build-fresh ensure-caddy-net ensure-base-images ensure-builder-base-image ensure-runtime-base-image build-base-images push-base-images generate-apk-checksums build-cli-docker prewarm-cli-docker
 
 BUILD_VERSION ?= latest
-BASE_GO_VERSION ?= 1.26.3
+BASE_GO_VERSION ?= 1.26.10
 BASE_ALPINE_VERSION ?= 3.23
-BASE_IMAGE_REVISION ?= 6
+BASE_IMAGE_REVISION ?= 7
 BASE_GO_IMAGE_VARIANT ?= alpine$(BASE_ALPINE_VERSION)
-BASE_GO_IMAGE_DIGEST ?= sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d
-BASE_ALPINE_IMAGE_DIGEST ?= sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
+BASE_GO_IMAGE_DIGEST ?= sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e
+BASE_ALPINE_IMAGE_DIGEST ?= sha256:21f3e19bafab57a9ff7aa9dd571dac72f868370472c10f450cc0416cc1aca553
 BASE_APK_BASE_URL ?= https://dl-cdn.alpinelinux.org/alpine/v$(BASE_ALPINE_VERSION)/main
 BASE_IMAGE_VERSION ?= $(BASE_GO_VERSION)-alpine$(BASE_ALPINE_VERSION)-r$(BASE_IMAGE_REVISION)
 BUILD_CADDY_NET := caddy_net

internal/testutil/dbtest/helpers.go

@@ -305,7 +305,7 @@ func newPostgresConnection(t *testing.T, models ...interface{}) (*database.Conne
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pg, err := postgres.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgres.WithUsername(username),
 		postgres.WithPassword(password),
 		postgres.WithDatabase(dbname),

metal/cli/clitest/helpers.go

@@ -29,7 +29,7 @@ func NewTestConnection(t *testing.T, models ...interface{}) *database.Connection
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pg, err := postgres.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgres.WithDatabase("testdb"),
 		postgres.WithUsername("test"),
 		postgres.WithPassword("secret"),

pkg/middleware/token_middleware_additional_test.go

@@ -33,7 +33,7 @@ func makeRepo(t *testing.T, account string) (*repository.ApiKeys, *auth.TokenHan
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pgC, err := postgrescontainer.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgrescontainer.WithDatabase("testdb"),
 		postgrescontainer.WithUsername("test"),
 		postgrescontainer.WithPassword("test"),

pkg/middleware/token_middleware_test.go

@@ -185,7 +185,7 @@ func setupDB(t *testing.T) *database.Connection {
 	// Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818
 	// and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18).
 	pgC, err := postgrescontainer.Run(ctx,
-		"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88",
+		"postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15",
 		postgrescontainer.WithDatabase("testdb"),
 		postgrescontainer.WithUsername("test"),
 		postgrescontainer.WithPassword("secret"),