Update docker-compose dependencies - #4685

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Renovate review: temporalio/ui 2.52.1 → 2.53.0 — looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing to block on.

Diff scope — 2 lines, image tag + pinned digest in docker-compose.yml:111 and docker-compose-dev.yml:147. These are the only two temporalio/ui references in the repo, so the bump is consistent. No source, config or logging changes, so the PII/secret-in-logs criterion is not engaged.

Digest verified — sha256:810eba47f77a89b0e64e2e751478ca585d037bbd90c0951a2974a92a6c5adeb9 matches the multi-arch index digest published for temporalio/ui:2.53.0 on Docker Hub (pushed 2026-07-29).

Upstream regression check (temporalio/ui-server v2.52.1...v2.53.0)

The Go side of the image is essentially untouched. The only non-asset changes in the whole range are:

• go.mod / go.sum — go.temporal.io/api 1.62.14 → 1.63.4, plus routine golang.org/x/{net,crypto,sys} patch bumps
• server/version/version.go — version string

Notably no changes under server/config, CORS or CSRF handling, so the env vars we set (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) behave exactly as before. Everything else in the range is regenerated SvelteKit bundle assets synced from temporalio/ui.

On the frontend side, v2.53.0 is dominated by internal refactors rather than behavior changes — Svelte runes migration of the button/holocene components, a TS strict mode enablement, and Standalone Activity / worker-deployment features that self-hosted PeerDB does not exercise. The one substantive change worth naming is the timeline rewrite (temporalio/ui#3627: SVG window virtualization, grouped-event buffer, workflow-task filtering, idle-time collapse). That is a perf win for the long histories our CDC workflows produce, but it is also the riskiest change in the release — if the workflow timeline renders oddly for a long-running mirror, that PR is the first place to look. It affects only the debugging UI, never the replication path.

I scanned open/closed temporalio/ui bug issues and found none filed against 2.53.0.

Two informational notes, neither blocking:

1. go.temporal.io/api moves to v1.63.4 while we still run temporalio/auto-setup:1.29. A newer API client against an older server is the supported direction — unknown proto fields are ignored and the UI gates features behind GetSystemInfo capability checks — so newer-server-only tabs simply stay hidden. No action needed.
2. Renovate flags 2.53.1 as pending. It carries real fixes (clickoutside pointerDown handling, duplicate schedule ID tolerance, self-hosted worker deployment actions), so the follow-up bump is worth taking when Renovate opens it.

🤖 Generated with Claude Code

Renovate review: temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — looks clean to merge.

Diff

Two lines, both the same image ref (docker-compose.yml:111, docker-compose-dev.yml:147). No other file in the repo references temporalio/ui, so the bump is complete and consistent.

Digest verification

sha256:102edb3c…4b8700 resolves to the 2.53.1 multi-arch index on Docker Hub (amd64 + arm64). The pin matches the tag.

Upstream review (temporalio/ui-server v2.52.1…v2.53.1)

The only non-generated changes on the server side are server/version/version.go and go.mod/go.sum; everything else is the vendored SvelteKit asset bundle. No changes under server/config or the CORS/CSRF handling, so the env vars this compose file sets (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) keep working unchanged.

Dependency deltas are all forward-safe / security-positive:

• go.temporal.io/api 1.62.14 → 1.63.4
• golang.org/x/net 0.54.0 → 0.55.0, golang.org/x/crypto 0.51.0 → 0.52.0, golang.org/x/sys 0.44.0 → 0.45.0

Upstream review (temporalio/ui v2.53.0, v2.53.1)

The bulk of the range is internal refactoring — Svelte runes mode enabled by default, holocene component migration, TS strict mode, Storybook 10. Feature work is Standalone Activities (batch ops, start delay, ExecutionTime search attribute) and Cloud / worker-deployment forms, none of which PeerDB uses. temporalio/ui#3709 folds in Dependabot security fixes. Bug fixes in the range (event-id param, live timeline refresh, JSON-navigator TypeError on empty events, duplicate schedule IDs) are improvements over 2.52.1. No breaking changes or config migrations are called out in either release.

Regression risk for PeerDB

Low. The Temporal UI container is standalone observability — nothing in flow/, ui/, or the e2e suite talks to it (only run-peerdb.sh and dev-peerdb.sh reference it, and only to pass --no-attach), so a UI regression cannot affect replication or CI. The new Standalone-Activity surfaces are gated behind namespace capability checks upstream, so they degrade rather than error against the temporalio/auto-setup:1.29 server this compose pins.

Notes (non-blocking)

• No PII/secret exposure introduced — the diff adds no logging or other output.
• Renovate flags 2.53.2 as pending (released 2026-08-11). It carries follow-up fixes to this line: schedules recent-run statuses, timeline group recoloring, marker billable-action dedupe, and an OIDC auth-cookie Secure attribute fix. The auth fix is irrelevant here (no auth is configured on this container). Nothing that argues against merging 2.53.1 now; 2.53.2 will land in a later Renovate run.

Reviewed this Renovate bump (temporalio/ui 2.52.1 → 2.53.1) per .claude/REVIEW.md. No findings — looks clean.

Scope: identical one-line image bump in docker-compose.yml and docker-compose-dev.yml. These are the only two references to temporalio/ui in the repo, so nothing was left behind.

Upstream check (temporalio/ui-server v2.52.1…v2.53.1): the entire non-generated-asset diff is go.mod / go.sum / server/version/version.go:

• go.temporal.io/api 1.62.14 → 1.63.4
• golang.org/x/net 0.54.0 → 0.55.0, x/crypto 0.51.0 → 0.52.0, x/sys 0.44.0 → 0.45.0

No changes to the UI server’s config or proxy code, so TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE behave as before. The go.temporal.io/api bump is additive proto/gRPC surface and the UI capability-gates new features, so it stays compatible with the pinned temporalio/auto-setup:1.29 server.

Release notes (v2.53.0, v2.53.1): dominated by a large Svelte-runes migration, TS-strict enablement, and Temporal Cloud worker-deployment / serverless-worker features (Cloud Run, Lambda, standalone activities). None of that is on a PeerDB code path — the UI container is view-only and no test or script talks to it. Bug fixes in range are UI-local (schedules defaults, timeline refresh, filter/table rendering).

Other checks:

• Digest sha256:102edb3cc9a549c8408bb5a867be944f6bc3889479770362e4c4c2067a4b8700 matches Docker Hub’s manifest-list digest for tag 2.53.1; the image is still multi-arch (linux/amd64 + linux/arm64), so arm64 dev machines are unaffected.
• No new stdout/stderr/log output, and no secret or PII exposure introduced.

Heads-up (non-blocking): upstream 2.53.2 (already listed as Pending by Renovate) carries follow-up fixes for regressions introduced in this 2.53.x refactor — schedule recent-run statuses, filter-bar pills on browser back/forward, timeline group recoloring, and an auth-cookie Secure fix. None of those affect PeerDB’s unauthenticated, self-hosted usage, but expect a quick follow-up bump once the minimum-release-age gate clears.

Dependency bump review: temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — the bump looks clean.

Diff. Two lines, the identical change in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files were bumped together, and a grep confirms these are the only temporalio/ui references in the repo, so there is no version skew. No new logging / stdout / stderr output, so the PII-and-secrets criterion is not applicable here.

Digest verification. The pinned sha256:102edb3cc9a549c8408bb5a867be944f6bc3889479770362e4c4c2067a4b8700 matches the current Docker Hub manifest index for tag 2.53.1 (published 2026-08-05), and it is a multi-arch index covering both amd64 and arm64.

Upstream range (73 commits, ui-server v2.52.1...v2.53.1). The Go backend is byte-identical. Comparing the server/ tree at both tags, every subdirectory SHA is unchanged — config, cors, csrf, auth, route, rpc, headers, api, server_options, and server.go. Only server/version differs. So the env-var contract this repo depends on (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) cannot have changed behavior in this range. Everything else in the range is embedded frontend assets.

go.mod moves forward only — no downgrades, no new replaces:

• go.temporal.io/api 1.62.14 → 1.63.4 (additive proto surface; the UI gates new features behind namespace capability checks, so it stays compatible with the pinned temporalio/auto-setup:1.29)
• golang.org/x/net 0.54.0 → 0.55.0, x/crypto 0.51.0 → 0.52.0, x/sys 0.44.0 → 0.45.0

Worth knowing, not a blocker. 2.53.0 / 2.53.1 carry an unusually large internal frontend refactor for a minor — Svelte 5 runes mode enabled by default (PR 3770) with roughly 35 component migrations, plus TypeScript strict turned on (PRs 3686 / 3687 / 3688). The blast radius is confined to UI rendering; it cannot reach the PeerDB data plane, since this container is only the Temporal Web console. Two self-hosted-relevant fixes also land in range: PR 3779 (worker deployment actions for self-hosted) and PR 3751 (tolerate duplicate schedule IDs).

Renovate flags 2.53.2 as pending. It is already released and contains follow-up fixes to that same refactor (PR 3796 filter-bar pills on back/forward nav, PR 3787 timeline group recoloring, PR 3799 schedule recent-run statuses). Nothing there fixes a regression that blocks merging 2.53.1 — those fixes will simply arrive with the next bump.

CI. No failing checks at review time. renovate/stability-days is satisfied; the flow_test matrix is still running.

🔄 Flaky Test Detected

Analysis: Infrastructure flake, not a code bug: the "Install Tilt" step got an HTTP 503 downloading the Tilt release tarball from GitHub, so no tests ever ran (the reported test-results.xml failures are downstream fallout) while the other two matrix legs on the same commit passed.
Confidence: 0.97

✅ Automatically retrying the workflow

View workflow run

Renovate bump review: temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — looks clean to merge.

Diff

Both docker-compose.yml and docker-compose-dev.yml updated consistently (tag + digest, nothing else). No new logging/output surface, so the PII/secret-exposure criterion is not applicable.

Digest verification

The pinned digest matches what Docker Hub serves for the 2.53.1 tag:
sha256:102edb3cc9a549c8408bb5a867be944f6bc3889479770362e4c4c2067a4b8700 (pushed 2026-08-05).

Upstream regression check

Compared temporalio/ui-server v2.52.1...v2.53.1 (73 commits) and read the temporalio/ui release notes for v2.53.0 / v2.53.1.

Server-side Go code is byte-identical. Every blob under server/ and the Dockerfile has an unchanged SHA except server/version/version.go (version string), plus dependency bumps:

• go.temporal.io/api 1.62.14 → 1.63.4
• golang.org/x/net 0.54.0 → 0.55.0, golang.org/x/crypto 0.51.0 → 0.52.0, golang.org/x/sys 0.44.0 → 0.45.0

That means the config surface we depend on is untouched — TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE behave exactly as before (server/config, server/cors, server/csrf, server/auth all unchanged). No auth/OIDC or TLS config is set in either compose file, so the auth-related churn upstream doesn't apply to us.

Everything else in the range is frontend. Notable churn worth being aware of, all cosmetic/UI-only and irrelevant to replication:

• v2.53.0: Svelte 5 runes migration of the whole Holocene component library, TypeScript strict enabled (3-part refactor), timeline HTML virtualization, standalone-activity and worker-deployment features (Cloud-oriented, namespace-capability gated).
• v2.53.1: "Enable runes mode by default", Storybook 10, standalone-activity fixes, dead-component removals.

Notes (informational, not blockers)

1. Renovate flags 2.53.2 as pending. It fixes three regressions that landed inside this range — event-history marker/billable-action deduping (fix(deps): update dependency protobufjs to v8 #3807), schedules recent-run statuses (classification: pg replica identity index dropped error #3799), and timeline group recoloring (Change normalize behaviour to default to normalizing 4 batches at a time #3787). All are display-only bugs in views PeerDB rarely uses; if the next Renovate run offers 2.53.2, taking it is slightly preferable.
2. Our Temporal server is pinned to temporalio/auto-setup:1.29 while this UI builds against API 1.63.4 (server 1.31-era). The UI capability-gates newer features, so pre-existing views keep working; any 1.30+/1.31-only feature simply won't light up. Pre-existing gap, not introduced here.

Renovate review: temporalio/ui 2.52.1 → 2.53.1 — looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing to block on.

Diff scope — 2 lines, image pin only in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files bumped consistently; no other reference to temporalio/ui exists in the repo. No secret/PII exposure surface (no new logging, env, or output).

Digest pin verified — sha256:102edb3c…4b8700 is the current Docker Hub digest for tag 2.53.1 (pushed 2026-08-05). Tag and digest agree.

Upstream ui-server v2.52.1…v2.53.1 (73 commits) — outside the bundled ui/assets/ build output, only three files changed:

• server/version/version.go (version string)
• go.mod/go.sum: go.temporal.io/api 1.62.14 → 1.63.4, golang.org/x/net 0.54.0 → 0.55.0, golang.org/x/crypto 0.51.0 → 0.52.0, golang.org/x/sys 0.44.0 → 0.45.0

No changes to the server's config/env handling, so the three env vars this compose service sets — TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE — are unaffected. No breaking changes, no removed or renamed config keys, no changed defaults on the server side.

Frontend changes (temporalio/ui v2.53.0 + v2.53.1) — no regression risk for how PeerDB uses this container. The bulk is internal refactoring (Svelte runes migration incl. runes mode enabled by default, TS strict mode, Storybook 10, dead-component removal). Feature work is Cloud/worker-deployment and Standalone Activities oriented (Enable server-scaled deployments by default, batch ops for standalone activities), plus bug fixes (Fix event id param, fix(schedules): tolerate duplicate schedule IDs, clickoutside pointer tracking, workflow JSON navigator TypeError on empty events). Nothing touching the workflow-list/workflow-detail paths PeerDB devs actually use, in a way that would regress them.

Non-blocking note: the UI now targets go.temporal.io/api v1.63.4 while the compose files pin temporalio/auto-setup:1.29 (latest server is 1.31.x). Newer standalone-activity / worker-deployment pages are gated behind namespace capability checks upstream, and the Temporal UI here is a dev-only debug console outside the data path — so this is cosmetic at worst. It's also pre-existing (2.52.1 already targeted API v1.62.14), not introduced by this PR.

Renovate flags 2.53.2 as pending; renovate/stability-days has passed for 2.53.1.

Review: temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — the bump looks clean.

Diff. Two-line image bump in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files bumped consistently, and no other reference to the Temporal UI version exists in the repo. Digest sha256:102edb3c… matches the published temporalio/ui:2.53.1 tag on Docker Hub (pushed 2026-08-05).

Upstream review (v2.52.1…v2.53.1). Checked the temporalio/ui-server commit log and the temporalio/ui release notes for v2.53.0 and v2.53.1.

• Server-side (the part PeerDB actually configures) is essentially untouched. The only non-frontend changes in ui-server across this range are go.mod/go.sum and server/version/version.go: go.temporal.io/api 1.62.14 → 1.63.4, golang.org/x/net 0.54.0 → 0.55.0, golang.org/x/crypto 0.51.0 → 0.52.0, golang.org/x/sys 0.44.0 → 0.45.0. Upstream also landed "surgical security upgrades for Dependabot alerts" (Fix routine Dependabot security alerts temporalio/ui#3709) — net positive.
• No config/env regressions. All three env vars we set still exist with the same names and semantics in config/docker.yaml at v2.53.1 (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE), and the container port default is still 8080, matching the 8085:8080 and 3030 mappings.
• Everything else is frontend. The bulk of the range is a large Svelte 5 runes migration ("Enable runes mode by default", ~60 component migrations, Storybook 10, TS strict mode), plus new Standalone Activities and Cloud Run worker-deployment features. That refactor is broad, so cosmetic UI regressions are the main theoretical risk; v2.53.1 already carries several follow-up fixes for it. Nothing touches CDC/QRep behavior — this image only serves the Temporal workflow browser.
• Compatibility. We pin temporalio/auto-setup:1.29. The new UI features (standalone activities, activity commands, batch ops on activities) are gated behind namespace capability checks (Use standaloneActivityOperatorCommands NS capability check temporalio/ui#3698), so they degrade gracefully when the server does not advertise them.

Notes (non-blocking).

• No new stdout/stderr/log output and no new secret- or PII-bearing env vars are introduced by this diff.
• v2.53.2 is pending in Renovate; it contains only further fixes (auth cookie Secure derivation, schedules, timeline coloring), so there is no reason to jump ahead of the normal Renovate cadence.

Renovate bump review: temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — the diff looks clean, so no inline comments were filed.

The diff. Two lines, identical tag+digest in both docker-compose.yml and docker-compose-dev.yml; grep -rn 'temporalio/ui' shows no other reference left behind, so there is no version skew between the prod and dev compose files. No new stdout/stderr/log output, so nothing on the PII/secret-exposure axis.

Upstream range (ui-server v2.52.1...v2.53.1, i.e. ui v2.53.0 + v2.53.1). Diffing the two tags, the only non-frontend-asset changes to the ui-server Go code are go.mod/go.sum and server/version/version.go — everything else is rebuilt SvelteKit assets. Concretely:

• go.temporal.io/api 1.62.14 → 1.63.4
• golang.org/x/net 0.54.0 → 0.55.0

No changes to the ui-server config/handler code, so the env-var surface this repo relies on (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) is untouched. Nothing in the range declares a minimum Temporal server version, and the new API-1.63 features are gated behind namespace capability checks upstream (e.g. standaloneActivityOperatorCommands), so temporalio/auto-setup:1.29 in these compose files stays compatible.

Regression risk worth knowing about. v2.53.0 is a large frontend refactor rather than a feature release: it turns on Svelte 5 runes mode by default (temporalio/ui#3770) and TypeScript strict mode (temporalio/ui#3686, #3687, #3688), plus a full migration of the Holocene component library. That is a lot of churn in exactly the screens PeerDB users touch — workflow list/detail, event history, timeline. Upstream has been shipping fixes for the fallout since:

• v2.53.1 (this PR): clickoutside pointer handling, WorkflowTaskFailedCause enum use, duplicate-schedule-ID tolerance.
• v2.53.2 (already released; Renovate lists it as Pending here): filter-bar pills not resyncing on browser back/forward navigation, timeline group recoloring, schedule recent-run statuses resolved from visibility.
• v2.53.3 (released today): modal dismissal notifications, list-header spacing.

None of that touches the PeerDB data plane — temporal-ui is observability-only here (Tiltfile link, port 8085 / 3030 CORS origin), so the blast radius is a dev/ops UI at worst. Merging 2.53.1 is fine; but since 2.53.2 fixes browser-navigation and timeline bugs in the workflow views, it is worth letting Renovate's follow-up PR land promptly rather than sitting on 2.53.1.

One thing I could not check from the review environment: Docker Hub registry access is blocked here, so I did not independently verify that sha256:102edb3c… is the current manifest-list digest for temporalio/ui:2.53.1 — that rests on Renovate's pinning plus the passing docker-build check.

Renovate dependency review — temporalio/ui 2.52.1 → 2.53.1 ✅

Reviewed per .claude/REVIEW.md. No findings — the bump looks clean.

What actually changed upstream

I diffed temporalio/ui-server v2.52.1...v2.53.1. Outside of the rebuilt ui/assets/** bundle, only three files changed:

No changes to the server's config/auth handling — nothing touching CORS, CSRF, TLS, or env-var parsing. The three settings we pass (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) are unaffected.

The temporalio/ui (frontend) commit range is ~100 commits, dominated by internal Svelte 5 runes migration, a TS-strict sweep, Storybook 10, and Temporal Cloud–only features (worker deployments, Cloud Run, serverless workers) that don't apply to self-hosted. Functional fixes relevant to a self-hosted UI: fix(schedules): tolerate duplicate schedule IDs (#3751), live-timeline refresh fix for completed event groups (#3689), Fix TypeError in workflow JSON navigator on empty events (#3696), Fix event id param (#3745), timeline HTML virtualization (#3627). Removals in the range (banner, compatibility-badge, api-pagination, workflow-filters, …) are all internal unused components, not user-facing features. Also picked up fix: surgical security upgrades for Dependabot alerts (#3709).

Checks against our review guidelines

• PII/secrets in output: no logging or output changes introduced — diff is two image tags.
• Regressions from the bumped range: none identified. No breaking config or API changes; no removed self-hosted functionality.

One thing worth being aware of (not a blocker)

The UI now builds against Temporal API v1.63.4 while we pin temporalio/auto-setup:1.29. New standalone-activity features are gated behind namespace capability checks (#3698, #3788), so they degrade rather than error on an older server. Worth a quick smoke check that the Temporal UI at :8085 loads and workflow history renders, since we don't have automated coverage for the UI container.

Consistency: both docker-compose.yml:111 and docker-compose-dev.yml:147 were updated to the same tag and digest, and those are the only temporalio/ui references in the repo — nothing stale left behind.

_{Note: I could not independently resolve the pinned digest against Docker Hub from this sandbox (registry egress blocked), so digest correctness is taken on Renovate's word; it is at least identical across both files.}

🔄 Flaky Test Detected

Analysis: Test_Partition_Key_Empty hit a fixed 60-second poll timeout in SetupCDCFlowStatusQuery while the mirror was still legitimately in STATUS_SNAPSHOT, failing in only one of three matrix legs on a Renovate docker-compose PR with no related code changes — a load/timing flake, not a real bug.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

Dependency bump review — temporalio/ui 2.52.1 → 2.53.1

Reviewed per .claude/REVIEW.md. No findings — the bump looks clean.

Diff sanity

• Both docker-compose.yml and docker-compose-dev.yml updated consistently; these are the only two references to temporalio/ui in the repo.
• Digest sha256:102edb3c…4b8700 matches the digest published for tag 2.53.1 on Docker Hub (pushed 2026-08-05), so the pin is genuine.
• No source changes, so nothing to flag for the log/stdout PII-and-secret rule.

Regression check (REVIEW.md rule 2)

I read the temporalio/ui-server and temporalio/ui commit logs for the v2.52.1...v2.53.1 range (the Renovate release-note block is empty because ui-server releases are just sync commits).

• Server side is effectively a no-op for us. The only non-generated changes in ui-server are go.mod (go.temporal.io/api 1.62.14 → 1.63.4, golang.org/x/net 0.54.0 → 0.55.0, x/crypto 0.51 → 0.52, x/sys 0.44 → 0.45) and server/version/version.go. No config-surface changes, so the TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE env vars we set remain valid. Compatible with the temporalio/auto-setup:1.29 server we pin.
• All the churn is frontend, and it is a lot of it: Svelte 5 runes migration across the whole Holocene component library (~50 commits), d8af57d enabling runes mode by default, a 3-part TypeScript strict migration, and a Storybook 10 upgrade. Functionally it also lands standalone-activity support, a virtualized timeline with idle-time collapsing, and a reformatted execution duration.
• Known regressions from that refactor are fixed in 2.53.2/2.53.3, not in 2.53.1. Upstream follow-ups include filter-bar pills not resyncing on browser back/forward (cf68d9e), timeline group mis-coloring when a later event extends the group (0c4b698), modal dismissal firing the wrong number of notifications (c487229), schedules recent-run statuses (04a1a50), and a further Dependabot security sweep (506d4f7, plus 43ffa6a bumping Go to 1.26.5).

Nothing above blocks this PR: our usage is the local workflow-inspection UI on localhost, the residual issues are cosmetic/navigational rather than data-affecting, and 2.53.2/2.53.3 are simply held back by our minimumReleaseAge: 7 days policy — they will roll forward in a later Renovate PR. Worth knowing that the Svelte-5 rewrite means the UI is more likely than usual to have visual rough edges at this exact version.

Note: 1ed8378 ("derive auth cookie Secure attribute from the OIDC callback URL") also lands in 2.53.2 and is worth remembering for any future OIDC-fronted deployment, but it does not apply to this compose setup, which uses no OIDC and sets TEMPORAL_CSRF_COOKIE_INSECURE=true.

Review: temporalio/ui 2.52.1 → 2.53.2 — looks clean ✅

Reviewed per .claude/REVIEW.md (dependency-bump checklist + secret/PII-in-logs check). No findings; no inline comments to post.

Diff scope: identical one-line image bump in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files updated consistently, and there are no other temporalio/ui pins in the repo.

Digest verified: sha256:0c89f0e96b8d8b53d35610e7b2a7d7fd4ea37175acc6e0f92923b75ef4dfc493 is the current Docker Hub manifest digest for temporalio/ui:2.53.2 — tag and digest match.

Upstream regression review (temporalio/ui-server v2.52.1…v2.53.2 — releases are auto-synced from temporalio/ui, so I read the temporalio/ui changelog plus the ui-server Go diff):

• The only non-asset Go changes in the whole range are server/auth/* and server/route/auth.go from fix(auth): derive auth cookie Secure attribute from the OIDC callback URL (#3806). Behavior change: the Secure attribute on the user*/refresh/session_start/state/nonce cookies is now derived from the scheme of the configured OIDC callbackUrl instead of c.Request().TLS != nil, and ui-server now log.Fatals at startup if the callback URL scheme is neither http nor https. This code path only runs when OIDC auth is configured (SetAuthRoutes), which our compose files do not do — they only set TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE. No impact for us; worth knowing for anyone layering SSO on top of these files behind a TLS-terminating proxy (Secure now follows the https callback URL rather than being dropped).
• TEMPORAL_CSRF_COOKIE_INSECURE=true still applies: the Codec.CookieInsecure config field is present unchanged at v2.53.2, so local HTTP access to the UI keeps working.
• Everything else is frontend-only: Svelte runes migration of the holocene component library, TS strict mode, Storybook 10, timeline virtualization, Standalone Activities / worker-deployment features (gated behind server namespace capability checks), plus assorted fixes. Nothing changes the UI's routes or its contract with the Temporal server, and nothing in PeerDB's code links into or scrapes the Temporal UI.
• go.temporal.io/api moved 1.62.14 → 1.63.4 in ui-server. This is the UI's own client dependency; the new features it exposes are capability-gated, so no incompatibility expected against our pinned temporalio/auto-setup:1.29 server. Worst case is a feature tab rendering empty, not a broken UI.
• No new stdout/stderr/log output touching credentials or PII. The token_refresh_failed/logout log lines in server/route/auth.go are pre-existing context in the diff and log only IP and error text.

Note: Renovate flags 2.53.3 as pending (minimum release age), so expect a follow-up bump shortly.

CI at time of review: docker-build, CodeQL JS/TS, migration-version and label checks passing; the three flow_test matrix legs and Analyze (go) were still running — those exercise the Temporal server rather than the UI container, so they aren't sensitive to this bump.

Reviewed this Renovate bump (temporalio/ui 2.52.1 → 2.53.2) against the upstream release notes and commit range — no findings, looks clean to merge.

What changed upstream

Renovate's notes come from temporalio/ui-server, where every release body is just "Release synced from ui@vX", so I read the actual temporalio/ui release notes for v2.53.0 / v2.53.1 / v2.53.2 plus the ui-server Go diff (v2.52.1...v2.53.2).

Go server side (the part we actually run in compose) — the range touches only 7 non-frontend files:

• server/auth/auth.go, server/route/auth.go — ui#3806: the auth cookie Secure attribute is now derived from the OIDC callback URL scheme instead of c.Request().TLS != nil. Note this adds a log.Fatal at startup if the callback URL has a non-http(s) scheme.
• server/version/version.go, go.mod / go.sum — go.temporal.io/api 1.62.14 → 1.63.4, plus golang.org/x/net, golang.org/x/crypto and golang.org/x/sys patch bumps.

Regression risk for us: none. SetAuthRoutes (and therefore the new fatal-on-bad-callback-URL path) only runs when SSO/OIDC auth is configured; our temporal-ui service sets only TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE and mounts no auth config, so those routes are never registered. server/config/config.go is unchanged across the range, so all three env vars we rely on keep the same semantics.

Frontend: v2.53.0 is a large internal refactor — Svelte runes mode enabled by default, TS strict turned on, holocene component migration — plus standalone-activity and schedules features. Those features are gated on namespace capabilities upstream and are console-only for us; v2.53.1 and v2.53.2 are mostly follow-up fixes to that refactor. We use the Temporal UI purely as a human-facing ops console (dev-peerdb.sh, run-peerdb.sh, Tiltfile just link to port 8085), so nothing automated depends on its markup or endpoints.

Mechanical checks

• Digest sha256:0c89f0e9… matches Docker Hub's published digest for tag 2.53.2 (pushed 2026-08-11), and the manifest list still carries both amd64 and arm64.
• Both pins (docker-compose.yml:111, docker-compose-dev.yml:147) were updated consistently; grep finds no other temporalio/ui reference in the repo.
• No PII/secret exposure: the diff adds no logging, and the pre-existing auth-path logging upstream (client IP on token refresh) is on a code path we do not enable.

Heads-up: Renovate flags 2.53.3 as pending (minimum release age); it adds a Go 1.26.5 bump and Dependabot security-alert fixes, so expect a follow-up PR shortly.

🔄 Flaky Test Detected

Analysis: Test_MySQL_Enum_Set_Consistency hit a 60-second wall-clock timeout waiting for the flow to leave STATUS_SNAPSHOT (test_utils.go:294) rather than any data assertion, and the same test passed on the identical mysql-gtid config in the pg16 matrix leg of this run, so this is load/timing flakiness unrelated to the Renovate docker-compose bump.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run

Renovate bump review: temporalio/ui 2.52.1 → 2.53.2

Reviewed per .claude/REVIEW.md. No findings — looks clean to merge.

Diff

Both docker-compose.yml:111 and docker-compose-dev.yml:147 are updated consistently, and the tag + sha256 digest pin is kept intact. No other references to temporalio/ui exist in the repo.

Upstream regression check (v2.52.1…v2.53.2)

The ui-server commits in this range are all "Sync from UI commit …", so I went through the temporalio/ui release notes for v2.53.0/.1/.2 plus the actual Go-side diff of ui-server.

Go/server-side changes are small and confined to OIDC auth:

• server/auth/auth.go + server/route/auth.go: the auth cookie Secure attribute is now derived from the OIDC callback URL scheme instead of c.Request().TLS != nil (fix(auth): derive auth cookie Secure attribute from the OIDC callback URL temporalio/ui#3806, v2.53.2). The new cookieSecureForCallbackURL calls log.Fatal at startup on a callback URL that is neither http nor https.
• go.temporal.io/api 1.62.14 → 1.63.4, plus routine golang.org/x/{net,crypto,sys} bumps.

Neither affects us: our temporal-ui service configures only TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE — no auth provider, so SetAuthRoutes is never wired up and the new fatal path is unreachable. The cors.cookieInsecure / cors.allowOrigins config fields are unchanged at v2.53.2, and there are no changes to the docker/ build or config-env plumbing in this range, so our env vars keep working as before.

Everything else in the range is frontend: a large Svelte 5 runes migration (runes mode on by default in v2.53.1), Storybook 10, TS strict mode, standalone-activities work, plus timeline/schedules/modal fixes. Cosmetic risk only, and this is Temporal’s default UI release.

Secrets / PII in output

No new logging is introduced by this range. The token_refresh_* log lines in server/route/auth.go that record client IPs predate v2.52.1 and sit on the auth path we do not enable. No passwords or tokens are logged.

Notes (non-blocking)

• v2.53.3 is already out (Renovate is holding it for minimum release age); it carries Dependabot security fixes and a Go 1.26.5 bump, so expect a follow-up PR.
• I could not verify from this sandbox that the digest resolves to tag 2.53.2 (registry access blocked) — Renovate generated it, and the docker-build CI job passed.

Reviewed this Renovate bump (temporalio/ui 2.52.1 → 2.53.2) — looks clean, no findings.

Digest pinning verified against upstream
sha256:0c89f0e9…f4dfc493 is the current Docker Hub digest for temporalio/ui:2.53.2 (pushed 2026-08-11). Both docker-compose.yml:111 and docker-compose-dev.yml:147 were updated consistently, and those are the only two temporalio/ui pins in the repo.

Upstream regression check (temporalio/ui-server v2.52.1…v2.53.2)
Server-side Go changes in the range are limited to:

• server/auth/auth.go, server/route/auth.go — ui#3806: the auth cookie Secure attribute is now derived from the OIDC callback URL scheme instead of c.Request().TLS != nil, and a callback URL with a non-http(s) scheme now log.Fatals at startup. This is entirely inside SetAuthRoutes, which only runs when OIDC auth is configured. PeerDB’s compose sets no TEMPORAL_AUTH_* vars, so this path is unreachable here.
• go.mod — go.temporal.io/api 1.62.14 → 1.63.4, plus routine golang.org/x/{net,crypto,sys} patch bumps.
• server/version/version.go — version string.

No changes to the config package, Dockerfile, or entrypoint, so the three env vars we set (TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE) are handled exactly as before.

Everything else in v2.53.0–v2.53.2 is frontend: the Svelte runes/Holocene migration (runes mode on by default), TS strict mode, timeline virtualization, Standalone Activities support, and assorted fixes. Standalone Activities is gated behind the standaloneActivityOperatorCommands namespace capability check, so nothing new is required from the Temporal server — our temporalio/auto-setup:1.29 stays compatible.

Other checks

• No new stdout/stderr/log output that could carry PII or secrets; the token_refresh_failed / logout log lines that include a client IP are pre-existing context, unchanged in this range.
• The Temporal Web UI is dev/ops tooling only (port 8085, --no-attached in run-peerdb.sh and dev-peerdb.sh); no PeerDB application code references it, so the blast radius of a UI regression is limited to local debugging.

FYI: Renovate flags v2.53.3 as pending — it adds further Dependabot security fixes and a Go 1.26.5 bump. Not a blocker for this PR; a follow-up bump will pick it up.

Review: temporalio/ui 2.52.1 → 2.53.2 — reviewed per .claude/REVIEW.md. No findings — looks clean to merge.

Diff. Two lines, identical change in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files stay in sync; these are the only temporalio/ui references in the repo.

Digest verified: sha256:0c89f0e96b8d8b53d35610e7b2a7d7fd4ea37175acc6e0f92923b75ef4dfc493 matches the manifest-list digest Docker Hub currently publishes for temporalio/ui:2.53.2 (pushed 2026-08-11).

Regression check on the bumped range. The Renovate-rendered release notes are empty (ui-server only records "synced from ui@..."), so I read the upstream temporalio/ui notes for v2.53.0/.1/.2 and diffed the ui-server Go tree across v2.52.1...v2.53.2.

Only five non-frontend files changed in the whole range:

Everything else is Svelte/TS: the Svelte 5 runes migration, TS strict mode, standalone-activity features, and Temporal Cloud worker-deployment UI. No behavioural change to how the UI talks to the Temporal server.

Impact on our deployment: none.

• The auth change is reached only from SetAuthRoutes, which runs only when an OIDC provider is configured. Our temporal-ui service sets just TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, TEMPORAL_CSRF_COOKIE_INSECURE — no auth provider, so that code path is dead for us. (Worth knowing for anyone who does enable SSO: a malformed or non-http(s) callbackURL is now a log.Fatal at startup rather than a silent fallback.)
• Both config keys we rely on still exist unchanged in server/config/config.go at v2.53.2 (cors.allowOrigins, cors.cookieInsecure). No env-var renames or removals in the range.
• No new logging of tokens, passwords, or PII. The token_refresh_failed ... ip=%s line in refreshTokens is pre-existing context, not added by this range, and is auth-path only.

Notes (non-blocking).

• We pin temporalio/auto-setup:1.29; UI 2.53.0 bumped its api-go dep to v1.63.4. The UI gates new surfaces behind namespace capability checks, so no compatibility concern against our server — just flagging the pairing.
• 2.53.3 is already out (Renovate lists it as pending) and carries Dependabot security-alert fixes plus a Go 1.26.5 bump. Nothing urgent, but the next Renovate run should pick it up.

🔄 Flaky Test Detected

Analysis: TestPeerFlowE2ETestSuiteMySQL_CH/Test_Addition_Removal hit its 4-minute EnvWaitFor deadline waiting for the flow to return to STATUS_RUNNING after an add-table signal, with no errors or assertion mismatches logged, and the same test passed on the other two matrix legs — a timing-related flake rather than a regression from this Renovate docker-compose PR.
Confidence: 0.8

✅ Automatically retrying the workflow

View workflow run

Renovate review: temporalio/ui 2.52.1 → 2.53.2

Reviewed per .claude/REVIEW.md. No findings — the bump looks clean.

Diff

Both compose files updated consistently (docker-compose.yml:111, docker-compose-dev.yml:147), and these are the only two references to temporalio/ui in the repo — nothing left behind. Digest verified against Docker Hub: temporalio/ui:2.53.2 currently resolves to sha256:0c89f0e9…f4dfc493, matching the pin.

Upstream regression check (v2.52.1…v2.53.2)

The image is built from temporalio/ui-server, which syncs from temporalio/ui. The Go/backend surface in this range is very small — the only non-test, non-frontend changes are:

Everything else in the range is frontend-only: the bulk is a large Svelte 5 runes migration (runes mode enabled by default, holocene component sweep, Storybook 10), TS strict mode, plus Standalone Activities and Worker Deployment / Cloud Run features. That is the main regression surface, but it is confined to the Temporal web console — it does not touch PeerDB replication logic, and none of it is exercised by our e2e suite.

Config compatibility

The three env vars we pass are all still present and unchanged in config/docker.yaml at v2.53.2:

• TEMPORAL_ADDRESS → temporalGrpcAddress
• TEMPORAL_CORS_ORIGINS → cors.allowOrigins
• TEMPORAL_CSRF_COOKIE_INSECURE → cors.cookieInsecure (explicitly not overloaded by the auth-cookie change above — the upstream PR rejected reusing this knob for exactly that reason)

Other checks

• No new stdout/stderr/log output touching PII or secrets — the only backend logging change is a log.Fatal on a malformed callback URL, which prints the URL and no credentials.
• No open upstream issues referencing 2.53.
• Renovate lists 2.53.3 as pending under the minimum-release-age rule; it will follow in a later PR.

Renovate review: temporalio/ui 2.52.1 → 2.53.3

Reviewed the bump against the upstream release notes and the ui-server commit range. No blocking findings — looks clean.

Diff sanity

• Both pins updated consistently (docker-compose.yml:111, docker-compose-dev.yml:147); no other temporalio/ui reference exists in the repo.
• Digest verified against Docker Hub: tag 2.53.3 resolves to sha256:eef301146e60fad34b47adaecfae4149016e34b2d44ba94fca5fd8e5441f182a, matching the pin.
• No logging/output changes in this PR, so no PII/secret-exposure surface.

Regression review of the bumped range

Ranged over ui-server v2.52.1...v2.53.3. Almost everything in v2.53.x is frontend: the Svelte runes migration (~50 component PRs), TS strict mode, Standalone Activities support, schedules/timeline fixes. Those are gated behind server capability checks and do not touch anything PeerDB depends on.

The only Go/server-side changes are:

1. fix(auth): derive auth cookie Secure attribute from the OIDC callback URL (ui#3806, v2.53.2) — the one behavioral change worth knowing about. Auth cookies now take Secure from the scheme of the configured OIDC callback URL instead of c.Request().TLS != nil, and SetAuthRoutes now log.Fatals at startup if the callback URL is missing or uses a non-http(s) scheme. Not applicable here: PeerDB's compose files do not set any TEMPORAL_AUTH_* variables, so SetAuthRoutes is never invoked. Flagging it only for anyone layering SSO on top of these files — a blank/malformed callback URL will now crash-loop the container rather than start.
2. Dependency/toolchain bumps — Go 1.26.3 → 1.26.5 in the builder image, go.temporal.io/api 1.62.14 → 1.63.5, grpc 1.79.3 → 1.82.1, golang.org/x/net 0.54 → 0.55, x/crypto 0.51 → 0.52, plus two Dependabot security-alert sweeps (ui#3709, ui#3815) and two supply-chain hardening fixes (VLN-1578, VLN-1585). All forward-moving and security-positive.

Compatibility with our config

TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE are all still honored in v2.53.3 (server/config/config.go unchanged apart from the auth path), and the container port is unchanged. No action needed.

Dependency bump review — temporalio/ui 2.52.1 → 2.53.3

Reviewed per .claude/REVIEW.md. No findings — this bump looks clean.

Diff scope. Two lines, image tag + digest, in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files updated consistently, and those are the only two references to temporalio/ui in the repo. The pinned digest sha256:eef3011…f182a matches the published temporalio/ui:2.53.3 manifest list on Docker Hub (pushed 2026-08-13).

Secrets / PII in logs. No new stdout/stderr/log output is introduced by this change, and nothing in the bumped range adds logging of credentials or tokens.

Regression review of the bumped range. The image is built from temporalio/ui-server, so I diffed v2.52.1...v2.53.3 there rather than relying only on the release notes. Outside the compiled SvelteKit assets, the only Go-side changes are:

Everything else in v2.53.0–v2.53.3 is frontend work PeerDB does not depend on: the bulk is a large Svelte 5 runes migration (runes mode on by default, holocene component + button strangler migration, Storybook 10), TypeScript strict mode, Standalone Activities / Nexus features, worker-deployment and schedules UI work, plus assorted UI bug fixes (timeline coloring, modal dismissal, duplicate schedule IDs, filter-bar back/forward resync). No breaking changes to the workflow views we use for CDC/QRep debugging, and no minimum-server-version bump — temporalio/auto-setup:1.29 stays compatible.

docker-build is green; the flow_test matrix was still running at review time.

Renovate review: temporalio/ui 2.52.1 → 2.53.3 — looks clean ✅

Reviewed per .claude/REVIEW.md.

Diff: identical one-line image bump in docker-compose.yml:111 and docker-compose-dev.yml:147. Both files stay in sync, and no other reference to the old tag exists in the repo (run-peerdb.sh/dev-peerdb.sh only refer to the service name, not a version).

Digest verified: sha256:eef3011…f182a matches the current multi-arch manifest-list digest for temporalio/ui:2.53.3 on Docker Hub.

Upstream review (v2.53.0 → v2.53.3):

• Server-side (temporalio/ui-server, the part that actually runs in this container) changed in only 5 non-frontend files across the whole range: Dockerfile, go.mod/go.sum, server/auth/auth.go, server/route/auth.go, server/version/version.go.
• The only behavioral server change is ui#3806 — auth cookies now derive their Secure attribute from the configured OIDC callback URL instead of request.TLS != nil. Not applicable here: PeerDB's temporal-ui service sets only TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE, with no OIDC/auth configuration.
• TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE config handling is untouched in the range (server/config has no diff), so the existing env vars keep working.
• Dependency bumps are routine security/maintenance: Go base image 1.26.3 → 1.26.5, go.temporal.io/api 1.62.14 → 1.63.5, grpc 1.79.3 → 1.82.1, plus golang.org/x/{net,crypto,oauth2,sys}. Two releases explicitly close Dependabot alerts (ui#3709, ui#3815) and harden CI actions.
• Everything else in the range is frontend work — a large Svelte 5 runes migration (runes mode enabled by default in v2.53.1), Storybook 10, TS strict mode, plus Cloud/Standalone-Activity features that require a newer Temporal server than the pinned auto-setup:1.29 and simply won't render here. Carries some cosmetic-UI-regression risk, but no impact on PeerDB's config surface or on flow execution — the UI is an observability convenience only.

No PII/secret exposure concerns: the diff adds no logging or output of any kind.

No blocking issues found.

Reviewed this Renovate bump per .claude/REVIEW.md — no findings, looks clean to merge.

What changed

Both docker-compose.yml and docker-compose-dev.yml updated consistently (same two images, same digests in both files).

postgres:18-alpine digest 9a8afca → d3e1620

This is not a bare rebuild — it moves the catalog from PostgreSQL 18.4 to 18.6 (the previous digest was pinned on 2026-07-27 in #4628, before the 18.6 build on 2026-08-15; 18.5 was never shipped due to a regression). 18.6 is a security release fixing 28 CVEs and 110+ bugs, so this is a bump worth taking.

Checked the 18.6 migration notes against our usage — none of the post-upgrade actions apply to the catalog:

• New output_plugin_libraries GUC (CVE-2026-6471) defaults to pgoutput, test_decoding. PeerDB only ever creates slots with pgoutput (flow/connectors/postgres/client.go:639), so no config change is needed here or for source peers.
• No GIN indexes (the reltuples corruption entry), no btree_gist, no ltree anywhere in the catalog schema — nothing to reindex.
• volumes/postgresql.conf only sets listen_addresses / wal_level / max_wal_senders / max_replication_slots; none of these changed in 18.6, so the container will still start with the mounted config.
• No dump/restore required for 18.X → 18.X.

Also confirmed 18.6 includes several logical-decoding fixes that are net-positive for us (empty prepared transactions no longer emitting COMMIT/ROLLBACK PREPARED without a preceding PREPARE, races dropping obsolete/ephemeral replication slots, stale progress reports during table sync).

temporalio/ui 2.52.1 → 2.53.3

Digest eef30114 correctly matches the 2.53.3 tag on Docker Hub. The four releases in range are overwhelmingly frontend work (Svelte runes migration, TS strict mode, standalone activities, Cloud-only worker-deployment features). Diffing v2.52.1...v2.53.3, the entire server-side surface is:

• server/route/auth.go, server/auth/auth.go — the cookie Secure attribute is now derived from the OIDC callback URL scheme instead of c.Request().TLS != nil (fix(auth): derive auth cookie Secure attribute from the OIDC callback URL temporalio/ui#3806).
• Dockerfile / go.mod — Go 1.26.3 → 1.26.5, go.temporal.io/api 1.62.14 → 1.63.5, plus routine golang.org/x and gRPC bumps (resolves open Dependabot alerts).
• server/version/version.go — version string.

No regression risk for us: the auth change only runs inside SetAuthRoutes, and our compose leaves TEMPORAL_AUTH_ENABLED at its false default. Note for anyone layering OIDC on top of this compose file: a callback URL with a missing or non-http(s) scheme is now a log.Fatal at startup rather than a silent fallback.

I also verified against config/docker.yaml at v2.53.3 that all three env vars we set are still recognized: TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE (still maps to cors.cookieInsecure).

Other checks

• No new stdout/stderr/log output, and nothing touching passwords or access tokens.
• UI 2.53.x against the pinned temporalio/auto-setup:1.29 is fine — the UI gates newer features behind namespace capability checks and supports server >= 1.16.
• .github/workflows/ci.yml uses an unpinned postgres:<matrix-version>-alpine, so CI already floats to 18.6 independently of this PR — no lockstep update needed.

🔄 Flaky Test Detected

Analysis: TestApiMariaDB/TestResyncWithSnapshotConfigOnRunningPipe hit a 3-minute "wait for flow dropped" timeout in only one of three matrix legs on a Renovate docker-compose pin bump that touches no Go code, which points to slow asynchronous teardown on a loaded runner rather than a real regression.
Confidence: 0.8

✅ Automatically retrying the workflow

View workflow run

Automated review — dependency bump ✅

Reviewed both digest/version bumps in docker-compose.yml and docker-compose-dev.yml. No findings — this looks clean to merge.

Verification

Both pins resolve to the tags they claim (checked against Docker Hub):

No secrets/PII surface is touched — the diff is four image lines.

postgres:18-alpine — this digest bump is not just an Alpine rebuild

Renovate labels this a "digest" update, but per docker-library/postgres @ 18/alpine3.24/Dockerfile the only commit in this window is "Update 18 to 18.6" (2026-08-13) — so the catalog Postgres actually moves from 18.4/18.5 to 18.6. Worth knowing, since this is also the user-facing quickstart compose.

18.6 is a large security release (~30 CVEs). Two migration notes from the 18.6 release notes are relevant here, and both were checked — neither requires action:

1. output_plugin_libraries whitelist (CVE-2026-6471) — 18.6 adds a GUC restricting which logical-decoding output plugins may load, defaulting to pgoutput, test_decoding. This matters because the catalog container runs wal_level = logical (volumes/postgresql.conf) and doubles as a CDC source in the dev/Tilt setup. PeerDB only ever creates slots with pgoutput (flow/connectors/postgres/client.go:639), which is in the default allowlist — no config change needed.
2. GIN reltuples corruption / btree_gist + ltree reindex — the catalog schema uses no GIN, btree_gist, or ltree indexes, so nothing to repair.

In-place 18.4/18.5 → 18.6 on an existing pgdata volume is a normal minor upgrade; no dump/restore. On the plus side, 18.6 carries several logical-decoding/replication-slot fixes (empty prepared-transaction decoding, slot drop/reuse races, decoding timeline race on standby promotion) that sit squarely in PeerDB territory.

temporalio/ui 2.52.1 → 2.53.3

ui-server releases are pure syncs of temporalio/ui, so the upstream notes for v2.53.0–v2.53.3 are the real changelog. The bulk of the range is Svelte runes migration, TS strict mode, and Temporal Cloud features (standalone activities, Cloud Run worker deployments) — none of it reachable from this config. Checked specifically for self-hosted regressions:

• fix(auth): derive auth cookie Secure attribute from the OIDC callback URL (ui#3806) — the one change that looked risky. It adds a log.Fatal on an unparseable callbackUrl, but that code lives in SetAuthRoutes, only reached when auth.enabled is true. TEMPORAL_AUTH_ENABLED is unset here and defaults to false, so the path is never taken. The PR also explicitly rejected reusing CORS.CookieInsecure to avoid changing behavior for operators who set TEMPORAL_CSRF_COOKIE_INSECURE — exactly this setup. No impact.
• Config surface — TEMPORAL_ADDRESS, TEMPORAL_CORS_ORIGINS, and TEMPORAL_CSRF_COOKIE_INSECURE are all still present in config/docker.yaml at v2.53.3. No renames or removals affecting these files.
• Enable server-scaled deployments by default (ui#3672) — Cloud worker-deployment UI; the serverScaledProviderCloudRun capability gate is preserved. The range also includes ui#3779 "Fix worker deployment actions for self-hosted deployments", so self-hosted moves in the right direction.
• Server compatibility — the UI bumps its API to v1.63.5 while we run temporalio/auto-setup:1.29. The UI feature-detects server capabilities, so there is no version floor issue.

Also folded in upstream: several Dependabot security fixes and two GitHub Actions supply-chain hardening PRs (checkout-below-v7, claude-code-action-unhardened).

🤖 Generated with Claude Code

🔄 Flaky Test Detected

Analysis: Two of three matrix legs hit the flow/e2e package's 20-minute timeout at ~1205s (killing 33 and 4 in-flight tests as "unknown"), while the third leg on the newest images passed clean — and the only genuine assertion, api_test.go:3517's ListWorkflow execution count, races Temporal's eventually-consistent visibility store with no retry.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

Renovate bump review — reviewed, looks clean ✅

Both bumps were checked against upstream release notes/commit logs per .claude/REVIEW.md. No regressions found, and nothing here touches logging or secrets. Both docker-compose.yml and docker-compose-dev.yml were updated consistently.

postgres:18-alpine digest 9a8afca → d3e1620

Labelled a digest-only update, but it is not just a base-image rebuild — the tag content moved:

(verified via docker-library/repo-info history and Docker Hub: d3e1620 is the current digest for 18-alpine = 18.6-alpine3.24. 18.5 was never released — pulled after a post-wrap regression.)

PG 18.6 (2026-08-13) is a security release covering 18 CVEs. Relevant checks for this repo:

• No dump/restore required for 18.4 → 18.6, so existing pgdata volumes are fine.
• Reindex advisories do not apply. 18.6 asks for a reindex when using btree_gist on float/bit columns, ltree with more than 14,653 labels, or parallel-built GIN indexes. The catalog schema (nexus/catalog/migrations/) uses only btree and USING HASH indexes, so nothing to do.
• New output_plugin_libraries GUC (CVE-2026-6471) restricts which logical decoding plugins can be loaded. Worth knowing because the catalog runs with wal_level = logical (volumes/postgresql.conf) and is often used as a source peer in local dev/demos. PeerDB only ever creates slots with pgoutput (flow/connectors/postgres/client.go:639, flow/e2e/generic_test.go:1069), which is in the default allowlist (pgoutput, test_decoding), so CDC is unaffected. Flagging it as a heads-up for users whose source Postgres upgrades to 18.6 with a non-default output plugin.
• Logical-replication changes in 18.6 are fixes (empty prepared transactions, timeline switching, WAL receiver conninfo), not behaviour regressions.

temporalio/ui 2.52.1 → 2.53.3

Diffed temporalio/ui-server@v2.52.1...v2.53.3. The Go/server side of the image changed in only a few places:

• server/auth/auth.go and server/route/auth.go — the auth cookie Secure attribute is now derived from the OIDC callback URL scheme instead of c.Request().TLS != nil, and a malformed callback URL now calls log.Fatal at startup. This is only reachable when SSO/OIDC auth is configured; these compose files set no TEMPORAL_AUTH_* vars, so that path is dead here.
• Dockerfile: Go 1.26.3 → 1.26.5, plus go.mod/go.sum bumps resolving open Dependabot alerts.
• Everything else is the Svelte UI bundle (runes migration, standalone activities, schedules fixes) plus API protos at v1.63.5.

No config-schema changes, so TEMPORAL_CORS_ORIGINS and TEMPORAL_CSRF_COOKIE_INSECURE (docker-compose.yml:109-110, docker-compose-dev.yml:145-146) are still honoured. Note the stack still pins temporalio/auto-setup:1.29 while the UI now ships v1.63.5 protos — newer UI features such as standalone activities are capability-gated and degrade gracefully against an older server, so this is informational, not a blocker.

Verification

• Both pinned digests match the current Docker Hub manifests for their tags (postgres:18-alpine → d3e1620…, temporalio/ui:2.53.3 → eef30114…).
• docker-build is green; the flow_test e2e matrix (including pg18) was still running at review time — worth a glance before merge, since the catalog container is the thing that changed.

Renovate bump review — reviewed, looks clean ✅

Both pins verified against the registry, and both upgrade ranges were read upstream. No blocking findings; no inline comments to leave.

Digest verification

Both files (docker-compose.yml, docker-compose-dev.yml) were updated consistently — grep finds no stale 2.52.1 / old-digest references anywhere else in the repo.

postgres:18-alpine digest bump — this is PG 18.4 → 18.6

The tag moved for a real PostgreSQL version change, not just an Alpine rebuild (base stays alpine-minirootfs-3.24.1). ENV PG_VERSION goes 18.4 → 18.6 (docker-library/repo-info). 18.5 was never shipped — skipped due to a regression. 18.6 carries 28 CVEs and 110+ bug fixes, so this is a bump worth taking.

Checked the three items in the 18.6 release notes that need action after updating:

• btree_gist float/bit reindex — n/a. The stack uses btree_gin (Temporal visibility), not btree_gist.
• ltree reindex — n/a. No ltree usage in the catalog schema.
• GIN reltuples may be Infinity/NaN after a parallel GIN build — ⚠️ potentially applicable, worth an operator note. Temporal's Postgres visibility schema creates GIN indexes on executions_visibility (by_temporal_change_version, by_binary_checksums, by_build_ids, by_temporal_pause_info), and Temporal shares this same catalog Postgres (DB=postgres12, POSTGRES_SEEDS=catalog). This only affects existing deployments with a persisted pgdata volume — a fresh docker compose up is unaffected, and autovacuum's ANALYZE corrects it on its own. Planner-quality only, not a correctness issue. The check, if anyone wants to run it:

  SELECT DISTINCT t.oid::regclass, t.reltuples FROM pg_class t
    JOIN pg_index i ON t.oid = i.indrelid
    JOIN pg_class ic ON i.indexrelid = ic.oid
   WHERE t.relhasindex AND ic.relam = 2742;

Relevant to PeerDB but not a regression here: CVE-2026-6471 adds a new output_plugin_libraries GUC that allow-lists logical decoding output plugins and refuses everything else. Its default is 'pgoutput, test_decoding', and PeerDB only ever creates slots with pgoutput (flow/connectors/postgres/client.go:639), so CDC is unaffected out of the box. Flagging it because customer-managed source Postgres instances upgrading to 18.6/17.11/16.15/… inherit this restriction too — harmless for us today, but it becomes a hard failure the moment a non-default plugin is in play.

temporalio/ui 2.52.1 → 2.53.3

Diffed v2.52.1...v2.53.3. Outside the bundled frontend assets, the Go server changes are only server/auth/auth.go + server/route/auth.go, plus Go 1.26.3→1.26.5, go.temporal.io/api 1.62.14→1.63.5, and gRPC/protobuf/x-net bumps.

• The one behavioral server change is ui#3806: auth cookies now derive Secure from the OIDC callback URL scheme instead of c.Request().TLS, and a malformed callbackUrl is now a log.Fatal at startup. No impact here — SetAuthRoutes returns early on !serverCfg.Auth.Enabled, and our compose sets no TEMPORAL_AUTH_* vars.
• TEMPORAL_CSRF_COOKIE_INSECURE=true / TEMPORAL_CORS_ORIGINS behavior is untouched; that PR explicitly rejected overloading CORS.CookieInsecure for exactly this reason.
• 2.53.0 is a large frontend refactor (Svelte runes mode on by default, TS strict). That's the main regression surface, but it has had three patch releases since and none of it reaches the server config we depend on.
• Server-version skew: 2.53.x targets API 1.63.5 while we run temporalio/auto-setup:1.29. New surfaces (Standalone Activities, Nexus operations) sit behind namespace capability checks, so they stay hidden rather than erroring.

Other

No stdout/stderr/log output added, and no secrets or PII in the diff.

CI note: renovate/stability-days is currently pending ("Updates have not met minimum release age requirement"), so automerge is gated until the release-age window passes — expected, not a problem.