Update dockerfile dependencies - #4682

Reviewed this Renovate bump — no findings, looks clean.

Digest verification

Both pins resolve to the current published manifest for their tag:

• docker/dockerfile:1.26 → sha256:ecfaec9e…95fc32 ✅ (Hub manifest digest, pushed 2026-07-29)
• mysql:9.7.2 → sha256:257388ed…a7ab4e ✅ (Hub manifest digest, pushed 2026-07-28)

docker/dockerfile 1.25 → 1.26 (moby/buildkit, dockerfile/1.25.0…dockerfile/1.26.0, 183 commits)

Release notes list a single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). Filtering the 300 changed files down to non-test frontend code, only three matter — builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go — and the only change to validations.go in this range is that same CopyIgnoredFile context-root fix (3c2df0f5). Everything else is vendoring, CI, and buildkit daemon/exporter-side work (e.g. exporter: default attestations to OCI artifacts, plus the platform-ID sanitization that was reverted again in 56cf3cc0), which the frontend pin does not pull in.

Hardening commits backported from v0.31.1 (security: validate exec security modes, user: limit size of parsed passwd/group files, fs: reject special files for ref reads) do not affect these Dockerfiles: neither uses RUN --security=…, and the --mount=type=cache,uid/gid and COPY --chown user lookups only touch the tiny /etc/passwd in the alpine/node base images.

The CopyIgnoredFile change is a lint-warning fix, not build semantics, and nothing in CI or the Tiltfile enables --check / BUILDKIT_DOCKERFILE_CHECK=error, so it cannot turn into a build failure here. docker-build is already green on this PR.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

No incompatible changes. Relevant to PeerDB's MySQL CDC path, the replication/binlog fixes are net-positive rather than regressions — e.g. row-based apply with stored TIMESTAMP NOT NULL columns (Bug #120128/#39182574), replication of deletes on self-referencing FK rows (#119996/#39091367), a race on writable replicas with log_replica_updates disabled (#39259437), and SOURCE_RETRY_COUNT=0 now consistently meaning unlimited reconnects (#39086875).

Checked the potentially disruptive items against this repo; none apply:

• Deprecated group_replication_communication_stack / group_replication_ip_allowlist — not referenced in stacks/mysql/my.cnf.sample; the settings it does use (log_bin, binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode, enforce_gtid_consistency) are untouched by 9.7.2.
• thread_pool_max_unused_threads default 2 → 32 — thread pool is an Enterprise plugin, not active in the community image.
• Enterprise Linux 7 / glibc 2.17 support dropped — does not affect the official Docker image.

Blast radius is also limited: stacks/mysql.Dockerfile is a local/manual dev image (its own header documents the docker build / docker run usage) and is not referenced by the Tiltfile or CI. The flow_test matrix pins mysql:9.5 and mysql:5.7 independently (.github/workflows/flow.yml:57-58).

_{Unrelated to this PR, just flagging: stacks/peerdb-server.Dockerfile pins the floating docker/dockerfile:1 tag rather than a minor tag, so it stays on a different frontend digest than the two files bumped here. Renovate tracks it separately.}

Review: dependency bump reviewed — looks clean ✅

No findings. Reviewed per .claude/REVIEW.md: no PII/secret output added, and upstream release notes plus commit logs were read for the full bumped range.

Digest/tag integrity — all three pinned digests match what the tags currently resolve to on the registry:

docker/dockerfile 1.25.0 → 1.26.0 (release, 2026-07-29) — exactly one notable change: buildkit#6930 "dockerfile: fix CopyIgnoredFile for context root", which stops COPY . . from being falsely reported as copying an ignored file when .dockerignore excludes dotfiles via .*. Warning-only, with no change to actual copy semantics — and our .dockerignore has no .* / * catch-all pattern regardless. There is no --check lint gating in the build workflows, so changed lint output cannot fail CI. The frontend features in use here (ADD --checksum=, RUN --mount=type=cache) are long-stable. No regression risk.

mysql 9.7.1 → 9.7.2 (relnotes, docker-library commit) — patch release, bug fixes only. The replication/binlog changes are all fixes (SOURCE_RETRY_COUNT=0 reconnect race, heartbeat and log-rotate event handling, row-based apply of generated TIMESTAMP NOT NULL, self-referencing FK deletes); nothing alters binlog wire format, binlog_row_metadata=full, or the GTID semantics that PeerDB MySQL CDC depends on. The two deprecations (group_replication_communication_stack, group_replication_ip_allowlist) and the thread_pool_max_unused_threads default change (2 → 32) do not touch stacks/mysql/my.cnf.sample, so mysqld startup is unaffected. Dropped EL7 support is irrelevant to the container image. This image is dev/test-only (bin_mysql), so blast radius is limited regardless.

node:24-alpine digest — resolves 24.18.0-alpine3.24 → 24.19.0-alpine3.24. Same Alpine base: the previous pin landed 2026-06-29, after Alpine 3.24 became the docker-node default (docker-node#2534, 2026-06-10), so this is a rebuild plus a Node minor, not a hidden Alpine major bump. The range picks up v24.18.1 (2026-07-29), a security release with 11 CVE fixes (HTTP/2 header memory retention, permission-model gaps, DNS large replies, TLS session binding/SNI, SQLite iterator invalidation, zlib overflow) — a net positive. The v24.19.0 additions are purely additive (blob.textStream(), TurboSHAKE/KangarooTwelve, --experimental-import-text, httpValidation, TCP keepalive knobs), with no deprecations or behavior changes affecting the Next.js build or runtime.

_{Non-blocking, pre-existing, and out of scope for this PR: .github/workflows/flow.yml:57 still pins the mysql-gtid matrix entry to a floating mysql:9.5, which now diverges two minors from the dev image.}

Reviewed this Renovate bump per .claude/REVIEW.md — no findings.

Digest verification

All three pins resolve to the tags they claim, checked against Docker Hub right now:

Upstream changes in the bumped range

docker/dockerfile 1.25 → 1.26 (moby/buildkit dockerfile/1.26.0, 2026-07-29)

The release notes list exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). The rest of the frontend-relevant commits in 1.25.0...1.26.0 are hardening / bug fixes — fileop: contain rm parent traversal, fs: reject special files for ref reads, security: validate exec security modes, dockerfile: fix Windows SBOM scanner temp mount. No Dockerfile syntax or semantic changes, and neither flow.Dockerfile nor peerdb-ui.Dockerfile uses anything affected — the --mount=type=cache usage in both is unchanged in behavior.

Note that stacks/peerdb-server.Dockerfile still pins docker/dockerfile:1@sha256:87999aa3… and was not touched. That is correct rather than a miss: the floating 1 tag upstream is itself still at 87999aa3 (last pushed 2026-05-20).

mysql 9.7.1 → 9.7.2 (release notes, LTS patch)

Nothing that looks like a regression risk for PeerDB. Several fixes land in our favour on the MySQL CDC path:

• SOURCE_RETRY_COUNT=0 now consistently means unlimited reconnects (Bug #39086875)
• Row-based apply no longer fails with Cannot be null on generated TIMESTAMP NOT NULL columns when explicit_defaults_for_timestamp is off (Bug #120128)
• Replication fixes for self-referencing FK deletes, heartbeat handling, binlog rotate events, and binlog transaction compression stats concurrency

The two incompatible changes in the release (EL7 support dropped, thread_pool_max_unused_threads default 2 → 32) do not affect this image. stacks/mysql.Dockerfile is the local dev/test image only; the CI matrix (mysql:9.5) and flow/e2e/test_data/mysql-debug/Dockerfile (8.0.46) are pinned separately and intentionally unchanged.

node:24-alpine digest bump — worth calling out, since Renovate labels it a "digest" update: it is not a rebuild, it is Node 24.18.1 → 24.19.0 (docker-node fd1bf45, v24.19.0, released 2026-08-03), i.e. a semver-minor within the 24 line. The Alpine base is unchanged (alpine:3.23; 3.22 was dropped back in June, well before the previous pin). Changes are additive API surface (blob.textStream(), --experimental-import-text, TCP_KEEPINTVL/TCP_KEEPCNT in setKeepAlive, certificateCompression) plus stricter crypto input validation (rejecting small-order EdDSA points, invalid raw key imports, large DH generator validation) — none of which the Next.js UI build or runtime exercises. No 24.19.1 has been cut in the nine days since release, and the arch-case removals in the upstream Dockerfile only drop x86/armv7/ppc64le, not the x86_64/aarch64 platforms we build.

Other checks

• No new stdout/stderr/log output, and nothing that could surface credentials or PII — the diff is four pinned-image lines. The pre-existing MYSQL_ROOT_PASSWORD placeholder in the mysql.Dockerfile header comment is untouched.
• docker-build is green on this PR; flow_test was still running at review time.

🔄 Flaky Test Detected

Analysis: TestApiMy/TestTableAdditionWithoutInitialLoad hit the fixed 60s polling deadline in SetupCDCFlowStatusQuery while the mirror was still in STATUS_SETUP — a wall-clock timeout under CI load on a Renovate Dockerfile bump, with the same suite passing on the other two matrix legs.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

🔄 Flaky Test Detected

Analysis: A whole-stack stall on the single maria-12 matrix leg made every MariaDB→ClickHouse test time out (mirrors stuck in STATUS_SETUP, CDC never delivered) until Go's 20m package timeout panicked and marked all 95 in-flight/waiting tests failed, while the other two matrix legs ran the same suites successfully against unchanged service images on a Renovate Dockerfile-bump PR.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

Reviewed this Renovate bump — no findings, looks clean to merge.

Digest verification. All three pins match what the tags currently resolve to on Docker Hub: docker/dockerfile:1.26 → sha256:ecfaec9e…95fc32 ✅, mysql:9.7.2 → sha256:257388ed…a7ab4e ✅, node:24-alpine → sha256:d32cdf61…e1ad43 ✅.

Upstream changes in the bumped ranges

• docker/dockerfile 1.25 → 1.26 (release, 2026-07-29) — only one notable change, and it is a fix: dockerfile: fix CopyIgnoredFile for context root (#6930), which removes an incorrect lint warning when matching .dockerignore patterns against COPY .. The other frontend-scoped commits in the range are a Windows SBOM scanner temp-mount fix and a docs clarification on WORKDIR tilde behavior. No syntax or semantic changes affecting flow.Dockerfile / peerdb-ui.Dockerfile, and no breaking changes. docker-build is green on this PR.

• mysql 9.7.1 → 9.7.2 (release notes, 2026-07-27) — patch release, no regressions relevant here. Several fixes are actually favourable for binlog-based CDC testing: SOURCE_RETRY_COUNT=0 now consistently means unlimited, a row-based apply fix for TIMESTAMP NOT NULL recomputation, binlog rotate/heartbeat handling fixes, and a BINLOG-with-REPLICATION_APPLIER fix. The behaviour changes in the release (thread_pool_max_unused_threads default 2 → 32, EL7/glibc 2.17 support removal, group_replication_communication_stack / group_replication_ip_allowlist deprecation) do not apply to this image: thread pool is an Enterprise plugin, the image is OL9-based, and no group replication is configured. Every option in stacks/mysql/my.cnf.sample is still valid in 9.7.2. Blast radius is small too — stacks/mysql.Dockerfile is a standalone local-dev helper not referenced by CI (flow.yml uses its own mysql:9.5 matrix entry).

• node:24-alpine digest a0b9bf0 → d32cdf6 — worth flagging since Renovate labels this merely a "digest" update: the rebuild corresponds to nodejs/docker-node@fd1bf45, which bumps Node.js 24.18.1 → 24.19.0, so this is a runtime minor bump rather than a plain rebuild. 24.19.0 is a regular LTS release (not a security release); its changes are semver-minor additions (blob.textStream(), --experimental-import-text, httpValidation, TCP keep-alive options, stream.compose marked stable), with no deprecations or removals that Next.js/npm rely on. That same upstream commit also dropped x86, armv7, ppc64le and s390x from the Node 24 image builds — not an issue here, since docker-bake.hcl only targets linux/amd64 and linux/arm64, both still supported.

No new stdout/stderr/log output is introduced, so this diff adds no PII or secret-exposure surface.

Informational, pre-existing and out of scope for this PR: stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3…, which Renovate did not update here (the PR body notes some dependencies could not be looked up). Tag 1 currently resolves to the same digest as 1.26, so that file will keep building on an older frontend until its pin is refreshed.

Renovate review: Update dockerfile dependencies — reviewed, looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing blocking. Details of the upstream-regression check below.

Digest verification

All three pins resolve to the tags they claim on Docker Hub (checked live against the registry):

docker/dockerfile 1.25 -> 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

The dockerfile/1.26.0 release notes list a single notable change, and the only non-test source changes under frontend/dockerfile in the 1.25.0…1.26.0 range are:

• moby/buildkit#6930 — fixes a false-positive CopyIgnoredFile warning for COPY . / COPY / when .dockerignore does not actually exclude the context root. Warning-only; no build-semantics change.
• dockerfile: fix Windows SBOM scanner temp mount — Windows-only, not applicable here.
• vendor: migrate to gohugoio/hashstructure in builder/resolvecache.go — internal hashing-lib swap; at worst a one-time frontend resolve-cache miss.
• A WorkdirRelativePath linter doc tweak — every WORKDIR in stacks/*.Dockerfile is absolute, so no new lint warnings.

No new required frontend capabilities and no syntax changes, so no regression risk for these two Dockerfiles. docker-build on this PR passes, which exercises both.

Minor pre-existing note (not this PR): stacks/peerdb-server.Dockerfile is still pinned to docker/dockerfile:1@sha256:87999aa3…, while the 1 tag now resolves to the same digest as 1.26. That stack therefore builds with an older frontend than the other two. Untouched here — flagging only in case the pinning inconsistency is unintentional.

mysql 9.7.1 -> 9.7.2 (stacks/mysql.Dockerfile)

Patch release (2026-07-28). Relevant items from the 9.7.2 release notes:

• The replication fixes are all on the replica/applier side (SOURCE_RETRY_COUNT=0 now consistently unlimited, self-referencing-FK delete replication failure, row-based TIMESTAMP NOT NULL recompute). Nothing changes binlog emission — no row-format, binlog_row_metadata, or GTID changes — which is what PeerDB's MySQL CDC consumes. stacks/mysql/my.cnf.sample (binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode=ON) is unaffected.
• Behavior change: thread_pool_max_unused_threads default 2 -> 32. Irrelevant for a local test image.
• Deprecations: group_replication_communication_stack, group_replication_ip_allowlist — not used in this repo.
• Dropped platform support: Enterprise Linux 7 — n/a for a container base.

Blast radius is small regardless: this image is a local/dev fixture, and CI's flow_test matrix uses mysql:9.5 (.github/workflows/flow.yml).

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)

Renovate labels this digest-only, but the underlying Node version does move — worth knowing rather than a problem:

• old a0b9bf06… = node 24.18.0-alpine3.24
• new d32cdf61… = node 24.19.0-alpine3.24

Same Alpine 3.24 base, so no musl/openssl distro jump (relevant because the base stage runs apk add --no-cache openssl). The delta pulls in:

• v24.18.1 (security release, 2026-07-29) — 11 CVEs including three High: http2 header-memory accounting (CVE-2026-56846), http2 deferred rst-stream (CVE-2026-56848), permission-model radix split nodes (CVE-2026-58043); plus llhttp 9.4.3 and undici 7.29.0. Net security win for the UI runtime.
• v24.19.0 (LTS, semver-minor) — additive APIs only (blob.textStream(), ReadableStreamTee, setKeepAlive TCP options, TLS certificateCompression, etc.). No removals or breaking changes affecting a Next.js 16 build, and ui/package.json declares no engines constraint.

Secrets / PII check

The diff touches only base-image pins — no new stdout/stderr/log output and no credentials. The pre-existing MYSQL_ROOT_PASSWORD=<some password> in the mysql.Dockerfile usage comment is an unchanged placeholder.

One thing to wait on

renovate/stability-days is still pending (minimum release age), so let that settle before automerge lands this.

Renovate review: Dockerfile dependency bumps — looks clean ✅

Reviewed per .claude/REVIEW.md. No blocking findings, so no inline comments. Digests verified against Docker Hub, and upstream release notes / commit logs read for each bumped range.

Digest verification

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile:1, stacks/peerdb-ui.Dockerfile:1)

183 commits upstream, but only one is a real Dockerfile-frontend behavior change: moby/buildkit#6930, which fixes a spurious dockerignore warning for COPY . at the context root. The rest is vendor bumps (containerd 2.2.5/2.3.2, runc 1.4.3, x/*, klauspost/compress), CI churn, buildkit-side hardening backported from v0.31.1 (validate exec security modes, limit size of parsed passwd/group files, reject special files for ref reads), and a WorkdirRelativePath lint-rule doc/validation refactor.

No regression exposure here:

• No RUN --security=… anywhere, so the exec-security-mode validation is a no-op for this repo.
• Every WORKDIR in stacks/ is absolute, so the WorkdirRelativePath rule change cannot fire.
• No docker build --check / BUILDKIT_DOCKERFILE_CHECK in CI, so lint changes cannot become build failures.
• --mount=type=cache and ADD --checksum= (both used in flow.Dockerfile) are untouched in this range.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile:4)

Maintenance release (2026-07-28): bug fixes across InnoDB, JSON, optimizer, and replication. Items worth knowing:

• Incompatible change: CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now reserved keywords. Checked the MySQL connector and e2e paths — no unquoted use of these as identifiers, so no impact.
• Deprecated: group_replication_communication_stack, group_replication_ip_allowlist. Neither is referenced in stacks/mysql/my.cnf.sample, which only sets binlog/GTID options — all still valid in 9.7.2.
• Default change thread_pool_max_unused_threads 2 → 32 (Enterprise thread-pool plugin, not applicable), and Enterprise Linux 7 packaging dropped (this image is oraclelinux9).
• The replication fixes target replica/applier behavior rather than binlog-client consumers, so PeerDB MySQL CDC is unaffected.

Blast radius is small: this Dockerfile is only the local convenience image described in its own header. The CI matrix uses upstream mysql:9.5 and mysql:5.7 (.github/workflows/flow.yml:57-58), so CI will not exercise 9.7.2.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile:4)

Renovate classifies this as digest-only, but the new digest is 24.19.0-alpine3.24, so it also rolls the Alpine base forward to 3.24. (The superseded a0b9bf0 digest landed in PR 4514 on 2026-06-29, when 24-alpine tracked Alpine 3.23; that tag has since been rebuilt, so the old digest is no longer resolvable to a tag.) The only package layered on top is openssl, and stacks/flow.Dockerfile:33 is already on alpine:3.24, so this reduces base-image skew across the stacks rather than adding it. Worth confirming the UI build stays green to rule out an openssl version surprise.

Other notes

• No new stdout/stderr/log output, and nothing that could surface passwords, tokens, or PII — the diff is three pinned references.
• Not covered by this PR: stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3…, which resolves to frontend 1.24.0. Because the digest wins over the tag, that image now builds two minors behind the other two. Pre-existing (Renovate tracks the floating 1 tag as a separate entry, and the PR body flags lookup failures against the Dependency Dashboard), so not a change request here — just flagging the drift.

🔄 Flaky Test Detected

Analysis: TestPeerFlowE2ETestSuiteBQ/Test_Soft_Delete_Basic hit its 3-minute EnvWaitFor deadline waiting for a CDC update to normalize into BigQuery (insert had already succeeded, no BQ/network errors logged), while the same test passed on the other two matrix legs of this Renovate Dockerfile-bump PR — a latency flake, not a regression.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run

🔄 Flaky Test Detected

Analysis: TestApiPg/TestResyncWithSnapshotConfigOnPausedPipe hit an UNEXPECTED TIMEOUT waiting 3 minutes for the flow to be dropped after termination in only 1 of 3 identical matrix legs, on a Renovate Dockerfile-only PR that cannot affect drop logic — a timing/race timeout rather than a real assertion failure, though the resync→terminate handoff deserves a look if it recurs.
Confidence: 0.78

✅ Automatically retrying the workflow

View workflow run

Dependency bump review — reviewed, looks clean ✅

All three digests were verified against the current Docker Hub tag digests, and the upstream release notes / commit ranges were read for each bump. No blocking findings; no changes to stdout/stderr/logging and no secret or PII exposure.

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

• sha256:ecfaec9… matches docker/dockerfile:1.26 (and currently also the floating 1 tag).
• dockerfile/1.26.0 (2026-07-29) lists exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). There are no intermediate frontend releases between 1.25.0 (2026-06-17) and 1.26.0; the rest of the 183-commit range is buildkit core/vendor/CI work that does not ship in the frontend image. No syntax changes, no new minimum BuildKit requirement.
• Neither Dockerfile uses a bare COPY . at context root, so the fixed warning is a no-op here — pure maintenance bump.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

• sha256:257388e… matches mysql:9.7.2 (pushed 2026-07-28).
• 9.7.2 release notes are a bug-fix patch. Behavior changes worth knowing, none of which affect this image's use: thread_pool_max_unused_threads default 2 → 32 (thread pool plugin is Enterprise-only), EL7/glibc 2.17 packaging dropped, group_replication_communication_stack and group_replication_ip_allowlist deprecated, libfido2 → 1.17.0.
• Replication/binlog changes are fixes rather than regression risk: SOURCE_RETRY_COUNT=0 now consistently means unlimited reconnects, crash race on binary_log_transaction_compression_stats, heartbeat/rotate-event handling, row-based apply no longer stopping when recomputing stored TIMESTAMP from NULL, self-referencing FK delete replication failure. Nothing conflicts with stacks/mysql/my.cnf.sample (log_bin=ON, binlog_format=ROW, binlog_row_metadata=full, GTID on).
• Blast radius is local dev only: this image is a standalone helper (built manually per the header comment; not referenced by docker-compose*.yml, Tiltfile, docker-bake.hcl or CI). CI MySQL coverage stays on mysql:9.5 (.github/workflows/flow.yml) and the pinned 8.0 mysql-debug fixture.

node:24-alpine digest a0b9bf0 → d32cdf6 (stacks/peerdb-ui.Dockerfile)

• The new digest resolves to 24.19.0-alpine3.24. The previous digest was pinned on 2026-06-29 (Update dockerfile dependencies #4514), when 24-alpine mapped to 24.18.0-alpine3.24 per docker-library/official-images at that date — so the Alpine series is unchanged (3.24), no musl/OpenSSL major shift under the apk add openssl in the base stage.
• The bump rolls up the 24.18.1 security release (2026-07-29: HTTP/2 header memory accounting, permission-model radix-tree grants, HTTPS agent key distinction, DNS large address replies, Buffer write validation) plus 24.19.0 additions (blob.textStream(), ReadableStreamTee, TLS group negotiation reporting). Still within Node 24 LTS; the repo has no engines field or .nvmrc to keep in sync.

Non-blocking observation (pre-existing, not introduced here)

stacks/peerdb-server.Dockerfile:1 still pins docker/dockerfile:1@sha256:87999aa…, which is frontend 1.24.0, while the 1 tag now resolves to 1.26. Nothing breaks (the digest pin is what is used), but the repo builds with two different frontend versions until Renovate's separate digest PR for that tag lands.

CI

docker-build, CodeQL, lint and migration checks are green; the flow_test e2e matrix was still running at review time.

Renovate bump review — clean ✅

Reviewed per .claude/REVIEW.md. No secret/PII exposure surface (no logging, stdout/stderr, or credential handling touched), and no regressions found in the bumped ranges. All three digests were verified against the registry.

docker/dockerfile syntax 1.25 → 1.26 (flow.Dockerfile, peerdb-ui.Dockerfile)

• Digest ecfaec9e… matches docker/dockerfile:1.26 on Docker Hub (pushed 2026-07-29); frontend release dockerfile/1.26.0 published the same day.
• Sole notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). I read the diff — it only adds a copySourceRootIgnored guard in dockerfile2llb/validations.go so the CopyIgnoredFile lint warning is suppressed for context-root sources. No change to emitted LLB, so build output is unaffected.
• Everything else in the 1.25.0…1.26.0 range is BuildKit-daemon-side (exporters, solver, vendoring) and is not shipped by the # syntax= frontend image. Notably exporter: default attestations to OCI artifacts does not come along with this pin.
• No syntax deprecations or removals. Both Dockerfiles only use long-stable features (RUN --mount=type=cache, ADD --checksum, COPY --chown/--from), nothing labs-gated.

mysql 9.7.1 → 9.7.2 (mysql.Dockerfile)

• Digest 257388ed… matches mysql:9.7.2 (pushed 2026-07-28). Release notes (2026-07-28).
• Behavior changes screened against stacks/mysql/my.cnf.sample, none apply:
  • thread_pool_max_unused_threads default 2 → 32 — the thread pool plugin isn't loaded here.
  • group_replication_communication_stack / group_replication_ip_allowlist deprecated — not used.
  • Enterprise Linux 7 support dropped — irrelevant to this image.
• Replication changes in the range are all bug fixes (SOURCE_RETRY_COUNT=0 retry handling, generated TIMESTAMP NOT NULL apply, self-referencing FK deletes, binlog compression stats crash). Nothing alters binlog_format=ROW / binlog_row_image / binlog_row_metadata / GTID semantics that the MySQL CDC connector depends on.
• Blast radius is small: stacks/mysql.Dockerfile is a manual dev helper (per its own header comment) and isn't referenced anywhere else in the repo — flow_test builds its MySQL from the matrix in .github/workflows/flow.yml.

node:24-alpine digest a0b9bf0 → d32cdf6 (peerdb-ui.Dockerfile)

• Resolves to 24.18.0-alpine3.24 → 24.19.0-alpine3.24. The Alpine base stays on 3.24, so no musl/openssl base change.
• This crosses v24.18.1, a security release fixing 11 CVEs, including three high-severity ones: CVE-2026-56846 (HTTP/2 header memory retention), CVE-2026-56848 (HTTP/2 reset stream handling), CVE-2026-58043 (permission system radix split node). Worth landing for that reason alone.
• v24.19.0 is semver-minor and purely additive (blob.textStream(), --experimental-import-text, httpValidation option, TLS certificateCompression, caller-supplied readFile buffers, ReadableStreamTee). Nothing removed or behavior-changing for the Next.js build/runtime.

Non-blocking note (pre-existing, outside this diff)

stacks/peerdb-server.Dockerfile:1 still pins # syntax=docker/dockerfile:1@sha256:87999aa3…, which is the 1.24 digest — it hasn't advanced since #4514, while the other two Dockerfiles have gone 1.24 → 1.25 → 1.26. Because it uses the floating 1 tag rather than a pinned minor, Renovate isn't proposing a digest refresh for it (plausibly the "Some dependencies could not be looked up" warning in this PR body). Not introduced here, but the three Dockerfiles now build with two different frontend versions — may be worth aligning separately.

Dependency bump review — clean ✅

Reviewed all three bumps against upstream release notes and verified the pinned digests resolve to the claimed tags on Docker Hub.

Digest verification

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

The only frontend behavior change in dockerfile/1.26.0 is a bug fix: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). The rest of the range is dependency/vendor updates (containerd v2.2.5, golang.org/x/*) and CI plumbing. No syntax or semantic changes affecting the features these Dockerfiles use (--mount=type=cache, ADD --checksum, multi-stage targets). No regression risk.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

MySQL 9.7.2 (2026-07-28) is a bugfix release. Relevant to PeerDB's MySQL CDC source, several fixes are actually favorable:

• Deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #39091367)
• Row-based apply of stored generated TIMESTAMP NOT NULL columns fixed when explicit_defaults_for_timestamp=OFF (Bug #39182574)
• binary_log_transaction_compression_stats concurrency crash fixed (Bug #36196212); heartbeat and event-rotate handling fixes

Behavior changes worth knowing (checked, none affect this repo):

• CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now reserved keywords (MANUAL/PARALLEL became non-reserved). Grepped the MySQL connector and e2e suites — no unquoted identifiers collide. The only QUALIFY in the tree is Snowflake SQL (flow/connectors/snowflake/qrep_avro_consolidate.go:200), unaffected.
• thread_pool_max_unused_threads default 2 → 32 (Enterprise thread pool plugin only, not used here).
• EL7 dropped upstream — irrelevant to the container image.

Note this image is dev/Tilt-only; CI's flow_test matrix pins mysql:9.5, so the blast radius is local development.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)

Renovate labels this a digest-only update, but it is materially a Node 24.18.0 → 24.19.0 move (old digest = 24.18.0-alpine3.24, new digest = 24.19.0-alpine3.24; Alpine base unchanged at 3.24, consistent with alpine:3.24 in flow.Dockerfile).

24.19.0 rolls up the 24.18.1 security release, which fixes several High-severity CVEs — HTTP/2 header memory retention in session accounting (CVE-2026-56846), HTTP/2 RST stream handling (CVE-2026-56848), permission-model radix split nodes (CVE-2026-58043) — plus Medium/Low fixes in HTTPS session reuse, SQLite, DNS resolveAny, and zlib. Semver-minor within the LTS line; docker-build is green.

Other checks

• No new stdout/stderr/log output; no credentials, tokens, or PII introduced. The only secret-adjacent line in the diff's neighborhood is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder comment in mysql.Dockerfile, which is a documentation placeholder, not a real value.
• Minor pre-existing inconsistency (not introduced here, no action needed): stacks/peerdb-server.Dockerfile still pins docker/dockerfile:1@sha256:87999aa3…, while the 1 tag now resolves to the same digest as 1.26. Renovate tracks that pin separately and should catch it up on its own.

No regressions found — good to merge once the remaining checks and the stability-days gate pass.

🔄 Flaky Test Detected

Analysis: All 9 failures on the single failing matrix leg are ~61s "UNEXPECTED STATUS TIMEOUT" waits on mirrors stuck in STATUS_SETUP/STATUS_SNAPSHOT across four unrelated suites, while the other two matrix legs passed on the same commit and all core services reported healthy — indicating runner-level stall/contention rather than a bug in this Renovate Dockerfile bump.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

Reviewed this Renovate bump against .claude/REVIEW.md. No findings — looks clean to merge.

Digest verification

All three pinned digests match what the tags currently resolve to on Docker Hub (no tag/digest mismatch):

Upstream release notes for the bumped range

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)
The range spans exactly dockerfile/1.25.0 → dockerfile/1.26.0 (no intermediate patch releases exist). The only documented change is moby/buildkit#6930 — fix an incorrect warning when matching .dockerignore patterns against COPY .. No syntax, semantics, or minimum-BuildKit-version changes. No regression risk.

Side note: stacks/peerdb-server.Dockerfile is pinned to the floating docker/dockerfile:1 rather than a pinned minor, so it is not updated in lockstep here. Pre-existing, out of scope for this PR.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)
MySQL 9.7.2 release notes (2026-07-28) is a bugfix-only release. Reviewed for anything touching the CDC surface:

• Several replication fixes land in our favour, notably deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #119996), row-based apply no longer fails on generated TIMESTAMP NOT NULL columns (Bug #120128), and SOURCE_RETRY_COUNT=0 is now consistently treated as unlimited.
• Deprecations are group_replication_communication_stack / group_replication_ip_allowlist — neither appears in stacks/mysql/my.cnf.sample.
• Changed default: thread_pool_max_unused_threads 2 → 32. Thread pool is not loaded in this image, so no effect.
• Dropped Enterprise Linux 7 packaging support — irrelevant to the container image.
• Nothing changes binlog format, binlog_row_metadata, or GTID behaviour, so my.cnf.sample stays valid as-is.

Worth noting for scope: this Dockerfile is a local/dev helper only. CI e2e runs pin mysql:9.5 and mysql:5.7 directly in .github/workflows/flow.yml, so this bump does not shift the tested MySQL matrix.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)
Tag stays 24-alpine, so the major line is unchanged. The 2026-08-03 push date lines up with Node v24.19.0 (LTS Krypton, npm 11.17.0), moving off the previous 24.18.1. v24.19.0 is a non-security release consisting of additive SEMVER-MINOR changes (blob.textStream(), caller-supplied readFile() buffers, --experimental-import-text, TLS certificate compression, dgram sync bind/connect). No removals or behaviour changes that affect the UI build; the repo declares no engines constraint or .nvmrc that could conflict.

Other review criteria

No new stdout/stderr/log output is introduced, so no PII or secret-exposure risk. The MYSQL_ROOT_PASSWORD=<some password> string in the mysql.Dockerfile header is a pre-existing usage-comment placeholder, not a real credential.

Renovate review: Update dockerfile dependencies — reviewed, looks clean ✅

No findings. Digests verified and upstream changes for each bumped range reviewed per .claude/REVIEW.md.

Digest verification (resolved against Docker Hub)

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

Frontend release notes for dockerfile/1.26.0 list a single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). Diffing dockerfile/1.25.0...dockerfile/1.26.0, the only non-test changes under frontend/dockerfile/ are builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go, version/version.go and linter docs — no syntax/semantic changes affecting our directives (--mount=type=cache, COPY --chown, multi-stage, build args). No regression risk identified.

Note: exporter: default attestations to OCI artifacts also landed in that commit range, but that is a BuildKit daemon/exporter change, not part of the frontend the # syntax= line pins, so it is not pulled in by this bump.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

Routine patch on the 9.7 LTS line (docker-library/mysql, 2026-07-27). Release notes are net-positive for our MySQL CDC path — several binlog/replication fixes (SOURCE_RETRY_COUNT=0 now consistently treated as unlimited reconnects, row-based apply with TIMESTAMP NOT NULL, binary_log_transaction_compression_stats race, event-rotate/heartbeat handling) plus InnoDB AUTO_INCREMENT and unique-index fixes.

Checked the two behavior changes for impact and both are non-issues here:

• thread_pool_max_unused_threads default 2 → 32 — thread pool plugin isn't enabled in stacks/mysql/my.cnf.sample.
• Enterprise Linux 7 support dropped — irrelevant to the container image.
• CUBE/EXTERNAL/QUALIFY/TABLESAMPLE are now properly reserved keywords — grepped flow/connectors/mysql and flow/e2e/mysql for those identifiers, no hits.

Blast radius is also small: stacks/mysql.Dockerfile is a dev-only helper (per its own header comment) and isn't referenced by any compose file, Tiltfile, workflow, or Go test. CI's MySQL service uses mysql:9.5 (.github/workflows/flow.yml:57) and the e2e debug image pins 8.0.46 — both untouched and unaffected.

node:24-alpine digest (stacks/peerdb-ui.Dockerfile)

Renovate labels this digest-only, but the tag moved Node 24.18.0 → 24.19.0. The previous digest was pinned in #4514 (2026-06-29, 24.18.0 era); 24-alpine now resolves to NODE_VERSION=24.19.0 on alpine:3.24.

This is a security-relevant bump: it rolls up 24.18.1 (2026-07-29), which fixed 11 CVEs including high-severity HTTP/2 header memory retention / RST-stream handling and a permission-model radix tree issue, and updated llhttp 9.4.3 / undici 7.29.0. 24.19.0 itself is semver-minor LTS (new blob.textStream(), TurboSHAKE/KangarooTwelve WebCrypto, --experimental-import-text, etc.) with no breaking changes. Alpine base line is unchanged from the previous pin (3.24), so apk add openssl in the base stage is unaffected.

No PII/secret output is added anywhere in this diff.

Unrelated FYI (pre-existing, not introduced here)

stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3… — that digest is the 1.24 frontend, so it's two minors behind. Because it uses the floating :1 tag instead of :1.25/:1.26, Renovate tracks it as a separate dependency and this PR doesn't touch it. Might be worth aligning it to 1.26 so all three images build with the same frontend.

🔄 Flaky Test Detected

Analysis: All 19 failures across the two failing matrix legs are uniform ~60s "UNEXPECTED STATUS TIMEOUT STATUS_SNAPSHOT/STATUS_SETUP" waits on disjoint, unrelated tests with no assertion mismatches or panics, while the pg18 leg passed on identical code — consistent with runner resource contention, not a bug in this Dockerfile-only Renovate change.
Confidence: 0.88

✅ Automatically retrying the workflow

View workflow run

Renovate dependency review — no findings

Reviewed per .claude/REVIEW.md. No PII/secret exposure in the diff (no new logging or stdout/stderr output), and I checked upstream release notes/commit logs for each bumped range. Verdict: clean.

docker/dockerfile syntax 1.25 → 1.26 (flow.Dockerfile, peerdb-ui.Dockerfile)

Compared dockerfile/1.25.0 (2026-06-17) → dockerfile/1.26.0 (2026-07-29) in moby/buildkit. The release carries exactly one notable change:

• Fix incorrect warning when matching dockerignore patterns to COPY . command (moby/buildkit#6930)

No syntax, semantics, or behavior changes — strictly a false-positive warning fix. Nothing in either Dockerfile (heredocs, --mount=type=cache, multi-stage) is affected. Digest ecfaec9e… verified as the current docker/dockerfile:1.26 manifest digest.

mysql 9.7.1 → 9.7.2 (mysql.Dockerfile)

MySQL 9.7.2 release notes (2026-07-28) — bug-fix-only patch, no behavior/default changes. Notable for PeerDB's MySQL CDC connector, all fixes rather than regressions:

• Deleting a row from a table with a self-referencing foreign key caused replication to fail (Bug #39091367)
• LOAD DATA could leave temporary NULL state on table fields when a row supplies NULL for a NOT NULL column (Bug #119996)
• JSON_VALUE() with RETURNING DATETIME + DEFAULT could return an invalid constant date in a DATE context
• Clone plugin fixes; connection-attribute parsing fix

No changes touching binlog format, GTID, or binlog_row_metadata, so stacks/mysql/my.cnf.sample stays valid. This image is a standalone local-dev helper (CI's flow_test matrix uses mysql:9.5/mysql-gtid separately), so blast radius is limited either way. Digest verified against docker-library/repo-info.

node:24-alpine digest a0b9bf0 → d32cdf6 (peerdb-ui.Dockerfile)

Worth flagging that Renovate classifies this as a digest update because the 24-alpine tag is unchanged, but the runtime actually moves Node 24.18.0 → 24.19.0 (through 24.18.1). Both are within Active LTS Krypton:

• 24.18.1 — security release: HTTP/2, HTTPS, Permission Model, SQLite, DNS, zlib, HTTP fixes
• 24.19.0 (2026-08-03) — purely additive APIs (blob.textStream(), TLS certificateCompression, --experimental-import-text, httpValidation, perf_hooks event-loop delay sampling), plus npm 11.17.0 and SQLite 3.53.3

No removals or breaking changes on the Node 24 line, so the Next.js build/runtime is unaffected — and docker-build (ubuntu-latest) passing on this PR confirms npm ci + npm run build still work. Digest verified against docker-library/repo-info.

lukemathwalker/cargo-chef digest ff60ee1 → 980619e (peerdb-server.Dockerfile)

Tag is unchanged (latest-rust-1.97.1-alpine) and cargo-chef itself has had no release since v0.1.78 (2026-04-13), so this is an image rebuild against a refreshed Rust/Alpine base rather than a tool change. No recipe-format or CLI changes to worry about.

Non-blocking observation (pre-existing, not introduced here)

stacks/peerdb-server.Dockerfile:1 still pins the floating docker/dockerfile:1 tag at sha256:87999aa3…, while the other two Dockerfiles now track 1.26. The 1 tag currently resolves to sha256:ecfaec9e… (identical to 1.26), so that pin is stale and the repo builds with two different frontend versions. Harmless today given how small the 1.25→1.26 delta is, but you may want to normalize all three onto the same pin style so Renovate keeps them in lockstep.

Reviewed this Renovate bump per .claude/REVIEW.md — no findings, looks clean.

Digest verification — all four pins match what the tags currently resolve to on Docker Hub:

Side note: peerdb-server.Dockerfile pins the syntax tag as 1 while flow/peerdb-ui pin 1.26. Both now carry the same digest, so this bump actually converges them (previously 1@87999aa diverged from 1.25@0adf442). No action needed.

Upstream review of the bumped ranges:

docker/dockerfile 1.25 → 1.26 (release notes, full compare) — the only frontend-behavior change called out is moby/buildkit#6930, fixing a spurious dockerignore warning on COPY .. Warning-only, no build semantics change. Non-test changes in frontend/dockerfile/ are limited to builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go and the WorkdirRelativePath lint docs — the latter is the "clarify WORKDIR tilde behavior" docs change, and every WORKDIR in stacks/ is absolute, so no new lint noise. MinBuildkitVersion is unchanged (version.go only moves 1.25 → 1.26), so no daemon-compatibility floor was raised. Most of the range is BuildKit daemon/solver/exporter work (e.g. exporter: default attestations to OCI artifacts) that is not shipped by the syntax= frontend image, so it does not apply here. The range does pull in several security hardenings that reach the frontend path (fs: reject special files for ref reads, fileop: contain rm parent traversal, source/git: reject option-like refs, solver: validate op input indices).

mysql 9.7.1 → 9.7.2 (release notes) — bugfix-only: X Plugin and Clone plugin fixes, an audit-log crash fix, libfido2 1.17.0, optimizer/CTE/ROLLUP fixes. One default change (thread_pool_max_unused_threads 2 → 32) and deprecations of group_replication_communication_stack / group_replication_ip_allowlist — none of which PeerDB's MySQL CDC touches, and no binlog/replication behavior changes. Also worth noting stacks/mysql.Dockerfile is a local dev helper; CI e2e runs against mysql:9.5 per .github/workflows/flow.yml, and flow/e2e/test_data/mysql-debug/Dockerfile pins 8.0.46 independently — neither is affected by this bump.

node:24-alpine and cargo-chef digest bumps — same-tag rebases only; the Rust toolchain stays pinned at 1.97.1 by the tag itself. No version movement.

Secrets/PII (REVIEW.md rule 1): no new stdout/stderr/log output introduced. The only credential-shaped string touched is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder in a usage comment.

docker-build is green on this PR.

Renovate dependency bump review — looks clean ✅

Reviewed per .claude/REVIEW.md. No blocking findings; no changes requested. Details of the upstream research below.

Digest verification

Every pinned digest resolves to the tag it claims (checked against Docker Hub):

The three Dockerfiles now all pin the same frontend digest, so docker/dockerfile:1 in peerdb-server.Dockerfile and :1.26 in the other two are equivalent today (pre-existing tag-string inconsistency, harmless).

Upstream changes in the bumped ranges

docker/dockerfile 1.25.0 → 1.26.0 (release notes) — 1.25.0 was the only 1.25.x, so this is exactly one release. Single notable change: fix for an incorrect dockerignore-pattern warning on COPY . (moby/buildkit#6930). No new syntax, deprecations, or breaking changes. flow.Dockerfile (COPY flow .) and peerdb-ui.Dockerfile (COPY ui/ .) are precisely the shapes that fix targets, so this is a small improvement. No labs-only features are used in any of our Dockerfiles, so the frontend swap is behavior-neutral otherwise.

node 24-alpine: 24.18.0 → 24.19.0 — the old digest a0b9bf0 was 24.18.0-alpine3.24 (2026-06-24); the new one is 24.19.0 (2026-08-03). This is a security-relevant bump: 24.19.0 carries the 2026-07-29 security release fixes shipped in 24.18.1 (HTTP/2, HTTPS, Permission Model, SQLite, DNS, zlib, HTTP), which the previous pin predated. Feature additions in 24.19.0 (blob.textStream(), TLS certificateCompression, --experimental-import-text, httpValidation) are all additive and unused by the UI build. Alpine base stays 3.24, matching the alpine:3.24 runtime stages elsewhere. Worth merging on the security grounds alone.

lukemathwalker/cargo-chef digest → 0.1.78 — ⚠️ worth flagging: Renovate labels this "digest", but the tag is latest-rust-*, so the floating latest moved. The old digest ff60ee1 is 0.1.77-rust-1.97.1-alpine and the new 980619e is 0.1.78-rust-1.97.1-alpine — i.e. a real cargo-chef 0.1.77 → 0.1.78 upgrade, not just a rebuild. v0.1.78 adds toml v1.1 support plus OCI annotations; no recipe.json format or breaking changes. Since chef, planner, and builder all derive from the same FROM, cargo chef prepare and cargo chef cook stay version-consistent. Rust toolchain is unchanged at 1.97.1. Expect a one-time dependency-layer cache miss on the next peerdb-server build.

mysql 9.7.1 → 9.7.2 (release notes) — patch release, replication section is all bug fixes (heartbeat handling, event rotate handling, SOURCE_RETRY_COUNT=0 treated as unlimited reconnects, a writable-replica race with log_replica_updates disabled, binary_log_transaction_compression_stats crash). No binlog format, row-event encoding, GTID, or client-protocol incompatibilities that would affect the MySQL CDC connector. Deprecations are Group Replication only (group_replication_communication_stack, group_replication_ip_allowlist) — unused here. The only mildly notable item is CUBE/EXTERNAL/QUALIFY/TABLESAMPLE becoming reserved keywords, and that's a non-issue for us since the connector backtick-quotes identifiers (flow/connectors/mysql/qrep.go:56, parsedTable.MySQL()).

Blast radius is also limited: stacks/mysql.Dockerfile is a dev-convenience image with no references from CI or compose — the flow test matrix pins mysql:9.5/mysql:5.7 separately (.github/workflows/flow.yml:57), so it is untouched by this bump.

Other checks

• No new stdout/stderr/log output, and nothing that could emit passwords or access tokens. The MYSQL_ROOT_PASSWORD=<some password> placeholder in the mysql.Dockerfile header comment is pre-existing and not a real credential.
• No changes to build args, entrypoints, exposed ports, or the USER/permission model in any of the four files.

Renovate dependency bump review — clean ✅

Reviewed all four Dockerfile changes against upstream release notes and registry state. No findings.

Digest verification

Every pinned digest matches what the corresponding tag currently resolves to on Docker Hub:

Regression check per bump

docker/dockerfile 1.25 → 1.26 (release) — single release in the range, one entry: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). No breaking changes, no syntax/feature removals. The cache mounts (--mount=type=cache with uid/gid) and multi-stage COPY --from used across all three Dockerfiles are unaffected.

cargo-chef digest → v0.1.78 (release, 2026-08-12) — "toml v1.1 support" plus OCI annotations. Rust toolchain stays pinned at 1.97.1, so no compiler change for nexus. The cargo chef prepare/cook interface is unchanged. Worst case is a one-time recipe-hash change invalidating the dependency-build cache layer — no correctness impact.

node:24-alpine → 24.19.0 (release) — Active LTS minor. Additive only (new stream/dgram/crypto APIs, TLS options, perf-hooks sampling) plus bundled npm/SQLite/zlib updates. Nothing deprecated or removed that the Next.js standalone build (npm ci → npm run build → node server.js) relies on. Node 24 stays Active LTS until 2026-10-20.

mysql 9.7.1 → 9.7.2 (release notes) — patch release. Scanned specifically for binlog/GTID/row-image changes since PeerDB's MySQL CDC reads the binlog; everything found is a fix, not a behavior change:

• "Deleting a row from a table with a self-referencing foreign key caused replication to fail" (Bug #39091367)
• Fixes to heartbeat handling, event rotate handling, and SOURCE_RETRY_COUNT=0 reconnect
• explicit_defaults_for_timestamp row-based apply fix for generated TIMESTAMP NOT NULL columns

No changes to binlog_row_image/binlog_row_metadata/gtid_mode semantics, so stacks/mysql/my.cnf.sample needs no update. Two notes, neither actionable here: the deprecations are Group Replication only (group_replication_communication_stack, group_replication_ip_allowlist), which is not used; and upstream dropped EL7 packaging support, which is irrelevant for the Docker image.

Also worth noting stacks/mysql.Dockerfile is a standalone local-dev helper — it is not referenced by CI or the Tilt stack (the flow_test matrix in .github/workflows/flow.yml pins mysql:9.5 independently), so the blast radius of the MySQL bump is local development only.

Other checks

• No new stdout/stderr/log output, and no secrets or PII introduced. The only credential-adjacent text is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder in the mysql.Dockerfile header comment — a placeholder, unchanged by this PR.
• docker-build (ubuntu-latest) is already green, confirming all images build with the new frontend.

🤖 Generated with Claude Code

Reviewed this Renovate bump per .claude/REVIEW.md — no findings, looks clean.

Digest verification

All pins resolve to the current manifest-list digest for their tag on Docker Hub:

Grep confirms these are the only syntax=docker/dockerfile / cargo-chef / node:24-alpine / mysql:9.x pins under stacks/ — nothing was left behind at an old digest.

Upstream release notes for the bumped ranges

docker/dockerfile 1.25.0 → 1.26.0 (release) — the tag-to-tag compare is large (183 commits across all of BuildKit), but only three commits touch non-test frontend/dockerfile/ source:

• dockerfile: fix CopyIgnoredFile for context root (moby/buildkit 6930) — the single item in the release notes; fixes a spurious dockerignore lint warning on COPY .. Bug fix only.
• dockerfile: fix Windows SBOM scanner temp mount — Windows-only, not exercised here.
• vendor: migrate to gohugoio/hashstructure (upstream module archived) — no behavior change.

The WorkdirRelativePath lint-rule docs also changed; every WORKDIR in stacks/*.Dockerfile is absolute (/root, /root/flow, /root/nexus, /home/peerdb, /app), so that rule cannot fire. No regression risk for these Dockerfiles.

cargo-chef 0.1.77 → 0.1.78 (changelog) — toml v1.1 support plus OCI image annotations. No breaking changes, and the toolchain in the tag is unchanged (rust-1.97.1-alpine), so the chef/planner/builder stages in peerdb-server.Dockerfile are unaffected.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28) — patch release. Relevant observations:

• The only default-value change is thread_pool_max_unused_threads 2 → 32, which belongs to the Enterprise thread pool plugin and is not active in the community image.
• Deprecations are group_replication_communication_stack and group_replication_ip_allowlist — neither is set in stacks/mysql/my.cnf.sample.
• Several fixes land in favour of CDC-style consumers: row-based apply with generated TIMESTAMP NOT NULL columns, self-referencing FK delete replication, SOURCE_RETRY_COUNT=0 reconnect handling, binlog rotate/heartbeat handling.
• Only mild compat wrinkle: CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now properly reserved keywords. Blast radius here is nil — stacks/mysql.Dockerfile is not referenced anywhere else in the repo (standalone local-dev helper); the e2e matrix in .github/workflows/flow.yml pins mysql:9.5 and mysql:5.7 independently.

node:24-alpine digest — corresponds to the 2026-08-03 rebuild of 24/alpine3.24 in nodejs/docker-node, a Node 24.x patch / base rebuild within the same major line. Nothing in peerdb-ui.Dockerfile depends on a specific patch version.

Other checks

• No new stdout/stderr/log output, and no passwords, tokens or PII introduced. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing placeholder in a usage comment, not a credential.
• Diff is digest/tag-only; no build logic, stage ordering, or RUN commands changed.

Renovate dependency review — reviewed, looks clean ✅

Reviewed per .claude/REVIEW.md. No findings — nothing to comment inline.

Digest verification

Every pinned digest in this PR resolves to the current upstream tag on Docker Hub (checked against the registry today):

Upstream release notes for the bumped range

docker/dockerfile 1.25.0 → 1.26.0 (release, 2026-07-29)
Single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY . command" (moby/buildkit#6930). No breaking changes, no new or changed lint rules or syntax semantics. The features these Dockerfiles rely on — RUN --mount=type=cache (with uid/gid), multi-stage FROM … AS, ADD --checksum, COPY --chown --from — are untouched. Regression risk: negligible.

node:24-alpine digest bump — this is Node 24.18.1 → 24.19.0 (LTS "Krypton", released 2026-08-03). The Alpine base is unchanged (alpine3.24 before and after — confirmed via the docker-library/official-images library/node diff, so no musl/openssl base shift). 24.19.0 is semver-minor only: blob.textStream(), ReadableStreamTee, TLS certificateCompression, --experimental-import-text, TCP_KEEPINTVL/TCP_KEEPCNT in setKeepAlive(), WHATWG stream perf. No breaking changes and no CVE-level disclosures. Nothing in the Next.js build (npm ci, next build, next dev --webpack) is affected.

lukemathwalker/cargo-chef digest bump — this is cargo-chef 0.1.77 → 0.1.78 (released 2026-08-12). Changes: toml v1.1 support, plus OCI annotations on the image. The Rust toolchain stays pinned at 1.97.1 by the tag, so cargo chef prepare/cook behaviour for nexus/ is unchanged. No regression risk.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28) — bug-fix release. Behaviour changes worth knowing about, none of which affect this repo:

• thread_pool_max_unused_threads default 2 → 32 (the thread pool plugin isn't loaded here).
• Enterprise Linux 7 packaging support dropped (irrelevant for the container).
• group_replication_communication_stack and group_replication_ip_allowlist deprecated (not used).

Nothing changed in binlog format, row image, GTID, or the client/server protocol, so there's no impact on the MySQL CDC connector. A couple of fixes are mildly favourable for replication (self-referencing-FK delete no longer breaks replication; SOURCE_RETRY_COUNT=0 now consistently means unlimited).

Scope note: stacks/mysql.Dockerfile is a standalone dev helper — the e2e/CI MySQL services come from MYSQL_GTID_IMAGE/MYSQL_POS_IMAGE in ancillary-docker-compose.yml, so this bump doesn't move the version the test matrix runs against.

Other checks

• No new stdout/stderr/log output, and nothing added that could print passwords or tokens. The only credential-adjacent line nearby is the pre-existing <some password> placeholder comment in stacks/mysql.Dockerfile, which is unchanged.
• renovate/stability-days is still pending (minimum release age) — automerge will hold until it passes.

🔄 Flaky Test Detected

Analysis: A single e2e test, TestGenericCH_PG/Test_Custom_Replication_Slot_Starting_With_Numbers_CDC_Only, hit its 180s wait-for-row-count timeout on the pg18/ch-latest matrix leg while passing on pg16 and pg17 in the same run, on a Renovate PR that only bumps Dockerfile dependencies — a timing flake rather than a real regression.
Confidence: 0.8

✅ Automatically retrying the workflow

View workflow run

Renovate bump review — clean ✅

Reviewed all four bumps against upstream release notes and commit logs per .claude/REVIEW.md. No regressions found, nothing blocking.

docker/dockerfile 1.25 → 1.26 (flow, peerdb-ui, peerdb-server)

dockerfile/1.26.0 (2026-07-29). Filtering the dockerfile/1.25.0...dockerfile/1.26.0 range down to files that actually ship in the frontend image, there are only two functional commits:

• 3c2df0f dockerfile: fix CopyIgnoredFile for context root — the only notable change. A lint-warning-only relaxation in dockerfile2llb/validations.go: COPY . . is no longer flagged as copying an ignored file when .dockerignore has patterns like .*; the warning is retained for catch-all root patterns (*, **, **/*). Strictly a false-positive fix, no build-behavior change.
• 7351945 dockerfile: fix Windows SBOM scanner temp mount — Windows-only, N/A here.

Everything else in the range (security: validate exec security modes, user: limit size of parsed passwd/group files, fs: reject special files for ref reads, plus solver/exporter fixes) is BuildKit daemon-side and does not ship in the frontend image, so it is not pulled in by the syntax= pin. No new LLB ops, so no minimum-daemon-version bump. None of our Dockerfiles use a context-root COPY . anyway, so the one behavior delta is a no-op for this repo.

Note that peerdb-server.Dockerfile pins docker/dockerfile:1 rather than :1.26, but both tags currently resolve to the same digest ecfaec9…, so all three files are consistent.

mysql 9.7.1 → 9.7.2

9.7.2 (2026-07-28) is the quarterly LTS patch. Checked specifically against stacks/mysql/my.cnf.sample — none of the options we set (log_bin, binlog_format, binlog_row_image, binlog_row_metadata, sync_binlog, max_binlog_size, gtid_mode, enforce_gtid_consistency, innodb-flush-log-at-trx-commit) is deprecated or removed. The only deprecations are group_replication_communication_stack and group_replication_ip_allowlist, which we do not use. Replication changes in the release are strictly bug fixes (SOURCE_RETRY_COUNT=0 treated as unlimited, self-referencing FK delete, row-based apply of TIMESTAMP NOT NULL).

Two items worth being aware of but non-blocking: EL7 packaging support was dropped (irrelevant to the container), and CUBE/EXTERNAL/QUALIFY/TABLESAMPLE are now properly reserved keywords — only a risk for unquoted identifiers, and PeerDB backtick-quotes MySQL identifiers. Also worth noting that stacks/mysql.Dockerfile has no references anywhere else in the repo (CI flow_test uses the mysql-gtid/mysql-pos matrix images, not this one), so the blast radius is local dev only.

node 24-alpine digest a0b9bf0 → d32cdf6

Renovate classifies this as digest-only because the tag is floating, but it is really 24.18.0 → 24.19.0, and it crosses 24.18.1 — a security release fixing 11 CVEs (3 high: CVE-2026-56846, CVE-2026-56848, CVE-2026-58043; plus 5 medium and 3 low across https/sqlite/dns/zlib/permission/http), and bundling llhttp 9.4.3 and undici 7.29.0. That makes this a meaningful security improvement rather than just a base-image rebuild. Node 24 stays LTS and the Alpine base is unchanged from the previous digest, so there is no impact on the apk add --no-cache openssl step.

Digest verification

All pinned digests resolve to the current head of their tags:

Other review criteria

No new stdout/stderr/log output and no secrets or PII introduced — the diff is four pinned image references. The MYSQL_ROOT_PASSWORD=<some password> string in stacks/mysql.Dockerfile is a pre-existing placeholder in a usage comment, untouched by this PR.

docker-build is already green; the flow_test matrix was still running at time of review.

🔄 Flaky Test Detected

Analysis: Not caused by the PR: only the ch-latest matrix leg failed, where all 151 *_CH_Cluster subtests hung in STATUS_SETUP until the 20m package timeout, while the identical code passed on ch-lts and ch-stable — an environment/upstream floating-tag ClickHouse cluster failure, though the uniform 100% failure rate means it may not self-heal on rerun.
Confidence: 0.7

✅ Automatically retrying the workflow

View workflow run

Renovate bump review — clean ✅

Reviewed all 4 changed lines in stacks/*.Dockerfile. No findings; nothing blocking.

Digest verification

All four pins were checked against Docker Hub and resolve correctly:

Upstream review of the bumped ranges

docker/dockerfile 1.25 → 1.26 (moby/buildkit dockerfile/1.26.0, released 2026-07-29)

• Single notable frontend change: #6930 — fixes a spurious warning when matching .dockerignore patterns against COPY .. Warning-only, no build-semantics change.
• The rest of the dockerfile/1.25.0…1.26.0 commit range is daemon-side (solver locking/race fixes, WCOW mounts, exporter/cache changes) and vendored dep bumps — none of that ships in the syntax= frontend image, so it does not affect these builds.
• No breaking changes, no deprecations, no new minimum-BuildKit requirement. None of the three Dockerfiles use syntax affected by the change.
• Note: peerdb-server.Dockerfile was still on the 1.24 digest (87999aa), so it actually moves 1.24 → 1.26. The only 1.25 notable was opt-in per-RUN CPU/memory limits (#6569) — not used here, so nothing to worry about. Side benefit: all three Dockerfiles now converge on the same frontend digest.

mysql 9.7.1 → 9.7.2 (release notes)

• Bugfix-only patch. Several fixes are directionally good for a CDC product: SOURCE_RETRY_COUNT=0 no longer stops the receiver after a transient disconnect (Bug 39086875), row-based apply fix for TIMESTAMP NOT NULL with explicit_defaults_for_timestamp off (Bug 39182574), self-referencing-FK delete replication fix (Bug 39091367), plus binlog heartbeat/rotate-event fixes.
• Incompatible changes are packaging/Group-Replication only: EL7 support dropped, and group_replication_communication_stack / group_replication_ip_allowlist deprecated. Neither applies here.
• Behavioural default change to be aware of: thread_pool_max_unused_threads 2 → 32 (Bug 39405207). Thread pool is an Enterprise plugin, so no effect on this image.
• Blast radius is small regardless: stacks/mysql.Dockerfile is a local dev helper only — it is not referenced by .github/workflows/flow.yml (CI uses mysql:9.5 / mysql:5.7) or any compose stack.

node:24-alpine digest a0b9bf0 → d32cdf6

• This is Node 24.18.0 → 24.19.0 on the same Alpine 3.24 base (the 3.23 → 3.24 default move already landed before the previous bump in Update dockerfile dependencies #4514), so no base-OS jump and no musl/openssl major change.
• The range crosses v24.18.1, a security release fixing 11 CVEs — three High (CVE-2026-56846, CVE-2026-56848 http2; CVE-2026-58043 permission model) plus http/https/dns/zlib/sqlite issues, and pulls in llhttp 9.4.3 / undici 7.29.0. Worth taking.
• v24.19.0 is a normal LTS minor (additive SEMVER-MINOR APIs, npm 11.17.0, sqlite 3.53.3). Nothing removed or behaviour-changing for a Next.js standalone build.

Other checks

• No new stdout/stderr/log output, and no PII or secrets introduced. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing usage-comment placeholder, not a credential.
• docker-build is already green on this PR.

Dependency bump review — clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing to comment on inline.

Digest verification

All four pins resolve to the tags they claim (checked against Docker Hub):

Side benefit: before this PR peerdb-server.Dockerfile was on a different frontend digest (87999aa) than flow/peerdb-ui (0adf442). All three now converge on the same 1.26.0 frontend.

Upstream release notes / commit log

docker/dockerfile 1.25 → 1.26 (dockerfile/1.26.0, released 2026-07-29 alongside BuildKit v0.32.0)

The only notable change called out upstream is "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). I diffed frontend/dockerfile/ between the two tags — apart from tests and docs, the only non-Windows source change is that fix in dockerfile2llb/validations.go, which suppresses the CopyIgnoredFile lint warning for context-root copies unless a root-level * / ** / **/* pattern exists. Our .dockerignore has no such pattern, so this is a no-op for COPY flow . and COPY --chown=node:node ui/ .. The remaining frontend commit (dockerfile: fix Windows SBOM scanner temp mount) is Windows-only.

Worth noting explicitly, since it looks alarming in the v0.32.x log: exporter: default attestations to OCI artifacts (#6914) — later worked around in v0.32.1 and reverted in v0.32.2 — lives in exporter/containerimage and control/, i.e. buildkitd, not the frontend image the # syntax= directive pulls. Bumping the syntax pin does not pick it up. Same for the solver/ race fixes and the s3-cache changes. No dockerfile/1.26.1 exists, and I found no open regression reports against the 1.26 frontend.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Patch release, mostly replication-applier and JSON fixes. I checked specifically for anything that could affect our MySQL CDC (binlog reader, GTID): nothing changes binlog event format or GTID semantics. The one replication fix that touches row events (Bug #120128 — TIMESTAMP NOT NULL recompute with explicit_defaults_for_timestamp disabled) is on the apply / mysqlbinlog replay path, which we do not use. Behaviour changes in the release — thread_pool_max_unused_threads default 2 → 32 (thread pool plugin, not in Community) and dropping Enterprise Linux 7 support (image is EL9-based) — are both inert here.

Also: stacks/mysql.Dockerfile is a standalone local dev convenience image (its own header documents docker build -f mysql.Dockerfile); nothing in docker-bake.hcl, the Tiltfile, or the CI matrix consumes it, so this bump does not touch test coverage. The e2e MySQL matrix (mysql:9.5) and the mysql-debug fixture (8.0.46, deliberately pinned by a renovate.json5 rule) are untouched, as intended.

node:24-alpine digest bump — NODE_VERSION 24.18.1 → 24.19.0 (confirmed via docker-library/repo-info), same Alpine base. Routine LTS Krypton minor: all additive semver-minor APIs (blob.textStream(), --experimental-import-text, httpValidation, TLS certificateCompression, etc.). Nothing removed or changed that the Next.js build or server.js runtime depends on, and ui/package.json declares no engines constraint. Note this also carries forward the 24.18.1 security release (CVE-2026-56846 … CVE-2026-58045).

Other checks

• No new stdout/stderr/log output, and no secrets, tokens, or PII introduced. The only credential-adjacent text is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder in the mysql.Dockerfile usage comment — a placeholder, not a real value.
• renovate/stability-days is currently pending ("minimum release age"). That is Renovate own automerge gate and should clear on its next run; it is not a problem with the change itself.

🤖 Automated dependency review

Reviewed per .claude/REVIEW.md. No blocking findings — this bump looks clean.

Digest verification

All four pins were resolved against Docker Hub and match what the diff claims:

docker/dockerfile:1 and :1.26 resolve to the same image, so peerdb-server.Dockerfile and flow.Dockerfile/peerdb-ui.Dockerfile stay in sync despite the different tag spellings.

Upstream release notes — regression check

docker/dockerfile 1.25 → 1.26 (release notes; 183 commits in dockerfile/1.25.0...dockerfile/1.26.0)

The only frontend-visible change is a bug fix: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930) — warning-only, and none of our Dockerfiles use COPY . at the context root anyway. Everything else in the range is BuildKit daemon/CI/vendor work (containerd, golang.org/x/*, solver locking, OCI attestation defaults) which the syntax= directive does not pull in. No breaking changes, no removed directives. Features we rely on — ADD --checksum= (flow.Dockerfile:35) and RUN --mount=type=cache with uid/gid (peerdb-ui.Dockerfile:18) — are unaffected.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Patch release, bug fixes only. Nothing touches the options in stacks/mysql/my.cnf.sample (binlog_format=ROW, binlog_row_image/binlog_row_metadata=full, gtid_mode=ON) — no deprecations or removals there. A couple of the fixes are actually favourable for CDC: deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #39091367), and a LOAD DATA bug that left stale NULL state on table fields is fixed (Bug #38939847). The deprecations in this release are group_replication_communication_stack / group_replication_ip_allowlist — unused here. Note this image is a standalone dev helper (not referenced from docker-compose-dev.yml, the Tiltfile, or CI), so blast radius is minimal; the MySQL matrix pins in .github/workflows/flow.yml are separate and untouched.

node:24-alpine digest bump

Same tag, rebuilt 2026-08-03 — routine Node 24 LTS patch plus Alpine base security updates. No major-version movement, so npm ci / next build are unaffected.

Secrets / PII (REVIEW.md rule 1)

No new logging, stdout/stderr output, or credential handling introduced. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing placeholder in a usage comment, not a real value.

_{Non-blocking nit, pre-existing: peerdb-server.Dockerfile pins the syntax tag as :1 while the other two use :1.26, which makes Renovate track them as two separate update streams (one "digest", one "minor"). Harmless today since they resolve identically, but unifying on :1.26 would keep future bumps in a single stream.}

🔄 Flaky Test Detected

Analysis: Timing-dependent duplicate emission in the brand-new TestCockroachDBSuite/Test_CDC_Exactly_Once_Across_Batches — the connector deliberately emits buffered records past the checkpoint when resolved timestamps stall beyond IdleTimeout+2s (cdc.go:489), which a loaded CI runner easily triggers; the other two CockroachDB matrix legs passed on identical code and the PR is a Renovate Dockerfile bump touching no Go code.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

Renovate dependency bump review — no findings

Reviewed per .claude/REVIEW.md. This is a 4-file, Dockerfile-only change (+5/-5). No new logging, stdout/stderr output, or anything that could leak secrets/PII was introduced.

Digest verification (all confirmed against Docker Hub)

Regression assessment

docker/dockerfile 1.25.0 → 1.26.0 (release, 183-commit range)

The syntax= directive only swaps the Dockerfile frontend, not buildkitd, so only the frontend-facing changes in the range matter. Non-test source changes under frontend/dockerfile are limited to:

• dockerfile: fix CopyIgnoredFile for context root (dockerfile: fix CopyIgnoredFile for context root moby/buildkit#6930) — the sole item in the release notes; fixes a spurious lint warning when matching .dockerignore patterns against COPY .. None of our four Dockerfiles use a bare COPY . at context root (flow.Dockerfile uses COPY flow ., the UI uses COPY --chown=node:node ui/ .), so this is a no-op here.
• dockerfile: fix Windows SBOM scanner temp mount — Windows/WCOW only.
• docs: clarify WORKDIR tilde path behavior + linter doc — docs only; no Dockerfile here uses a tilde WORKDIR.
• dockerfile: use containerd defaults for the gRPC max recv/send message size — replaces hardcoded constants with containerd defaults; no behavioral change at our scale.

The rest of the range is buildkitd-side (solver/exporter/executor) and does not ship with the frontend image — notably exporter: default attestations to OCI artifacts and the WCOW cache-mount hardening, which are daemon behaviors and unaffected by this bump. The range also carries the v0.31.1/v0.31.2 security patches (exec security-mode validation, passwd/group parse limits, fileop rm parent-traversal containment, git bundle ref validation, LLB input-index validation) — all daemon-side, but a good reason to be on the newer line.

No open buildkit issues report a 1.26 frontend regression. The features these Dockerfiles rely on — RUN --mount=type=cache, ADD --checksum, multi-stage COPY --from, ARG/ENV — are unchanged in the range. docker-build (ubuntu-latest) already passes on this PR.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Maintenance release: X Plugin and Clone plugin fixes, optimizer fixes (subquery_to_derived, ROLLUP, decimal aggregation error handling, CTEs, ExtractValue()), an audit_log_encryption_password_get() crash fix, libfido2 → 1.17.0, and thread_pool_max_unused_threads default 2 → 32. Deprecates group_replication_communication_stack and group_replication_ip_allowlist — neither is used here. Nothing touches binlog/GTID semantics that the PeerDB MySQL CDC connector depends on. Additionally, stacks/mysql.Dockerfile is a manual dev helper — it is not referenced by any workflow or the Tiltfile (CI provisions MySQL from mysql:9.5 in .github/workflows/flow.yml), so blast radius is limited to local use.

node:24-alpine digest — rebuild landing Node 24.19.0 / Alpine 3.24 on the LTS line. Same major, the ui/ build is unaffected.

Notes (non-blocking, pre-existing)

• stacks/peerdb-server.Dockerfile pins the floating docker/dockerfile:1 tag while flow.Dockerfile and peerdb-ui.Dockerfile pin 1.26. All three currently resolve to the same digest, so they stay in lockstep for now, but the tags will drift apart at the next minor. Worth normalizing if you want the three builds to move together.
• renovate/stability-days is still pending (minimum release age not yet met), and the flow_test matrix jobs were still running at review time — automerge will gate on those.

Verdict: clean, safe to merge once CI is green.

🔄 Flaky Test Detected

Analysis: All four failures are BigQuery normalize WaitFor timeouts clustered in a ~1-minute window across two independent matrix jobs, while the pg16 job passed the identical BQ suite on the same commit — a transient BigQuery latency issue on a Dockerfile-only Renovate PR, not a code bug.
Confidence: 0.92

✅ Automatically retrying the workflow

View workflow run

🔄 Flaky Test Detected

Analysis: A Renovate Dockerfile-only PR failed with a rotating subset of BigQuery e2e tests hitting 180s "UNEXPECTED TIMEOUT" waiting for normalization (different tests on attempt 1 vs attempt 2, and the same tests passed in a parallel matrix leg on the same commit), indicating transient BigQuery/runner contention rather than a real bug.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run