Update dockerfile dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/dockerfile	syntax	minor	1.25 → 1.26
docker/dockerfile	syntax	digest	87999aa → ecfaec9
mysql (source)	final	patch	9.7.1 → 9.7.2
node (source)	final	digest	a0b9bf0 → d32cdf6

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Reviewed this Renovate bump — no findings, looks clean.

Digest verification

Both pins resolve to the current published manifest for their tag:

• docker/dockerfile:1.26 → sha256:ecfaec9e…95fc32 ✅ (Hub manifest digest, pushed 2026-07-29)
• mysql:9.7.2 → sha256:257388ed…a7ab4e ✅ (Hub manifest digest, pushed 2026-07-28)

docker/dockerfile 1.25 → 1.26 (moby/buildkit, dockerfile/1.25.0…dockerfile/1.26.0, 183 commits)

Release notes list a single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). Filtering the 300 changed files down to non-test frontend code, only three matter — builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go — and the only change to validations.go in this range is that same CopyIgnoredFile context-root fix (3c2df0f5). Everything else is vendoring, CI, and buildkit daemon/exporter-side work (e.g. exporter: default attestations to OCI artifacts, plus the platform-ID sanitization that was reverted again in 56cf3cc0), which the frontend pin does not pull in.

Hardening commits backported from v0.31.1 (security: validate exec security modes, user: limit size of parsed passwd/group files, fs: reject special files for ref reads) do not affect these Dockerfiles: neither uses RUN --security=…, and the --mount=type=cache,uid/gid and COPY --chown user lookups only touch the tiny /etc/passwd in the alpine/node base images.

The CopyIgnoredFile change is a lint-warning fix, not build semantics, and nothing in CI or the Tiltfile enables --check / BUILDKIT_DOCKERFILE_CHECK=error, so it cannot turn into a build failure here. docker-build is already green on this PR.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

No incompatible changes. Relevant to PeerDB's MySQL CDC path, the replication/binlog fixes are net-positive rather than regressions — e.g. row-based apply with stored TIMESTAMP NOT NULL columns (Bug #120128/#39182574), replication of deletes on self-referencing FK rows (#119996/#39091367), a race on writable replicas with log_replica_updates disabled (#39259437), and SOURCE_RETRY_COUNT=0 now consistently meaning unlimited reconnects (#39086875).

Checked the potentially disruptive items against this repo; none apply:

• Deprecated group_replication_communication_stack / group_replication_ip_allowlist — not referenced in stacks/mysql/my.cnf.sample; the settings it does use (log_bin, binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode, enforce_gtid_consistency) are untouched by 9.7.2.
• thread_pool_max_unused_threads default 2 → 32 — thread pool is an Enterprise plugin, not active in the community image.
• Enterprise Linux 7 / glibc 2.17 support dropped — does not affect the official Docker image.

Blast radius is also limited: stacks/mysql.Dockerfile is a local/manual dev image (its own header documents the docker build / docker run usage) and is not referenced by the Tiltfile or CI. The flow_test matrix pins mysql:9.5 and mysql:5.7 independently (.github/workflows/flow.yml:57-58).

_{Unrelated to this PR, just flagging: stacks/peerdb-server.Dockerfile pins the floating docker/dockerfile:1 tag rather than a minor tag, so it stays on a different frontend digest than the two files bumped here. Renovate tracks it separately.}

[claude]

Review: dependency bump reviewed — looks clean ✅

No findings. Reviewed per .claude/REVIEW.md: no PII/secret output added, and upstream release notes plus commit logs were read for the full bumped range.

Digest/tag integrity — all three pinned digests match what the tags currently resolve to on the registry:

Image	Change	Digest verified
docker/dockerfile	1.25 → 1.26	ecfaec9… = 1.26 / 1.26.0 ✅
mysql	9.7.1 → 9.7.2	257388e… = 9.7.2 / 9.7 ✅
node:24-alpine	a0b9bf0 → d32cdf6	d32cdf6… = 24.19.0-alpine3.24 ✅

docker/dockerfile 1.25.0 → 1.26.0 (release, 2026-07-29) — exactly one notable change: buildkit#6930 "dockerfile: fix CopyIgnoredFile for context root", which stops COPY . . from being falsely reported as copying an ignored file when .dockerignore excludes dotfiles via .*. Warning-only, with no change to actual copy semantics — and our .dockerignore has no .* / * catch-all pattern regardless. There is no --check lint gating in the build workflows, so changed lint output cannot fail CI. The frontend features in use here (ADD --checksum=, RUN --mount=type=cache) are long-stable. No regression risk.

mysql 9.7.1 → 9.7.2 (relnotes, docker-library commit) — patch release, bug fixes only. The replication/binlog changes are all fixes (SOURCE_RETRY_COUNT=0 reconnect race, heartbeat and log-rotate event handling, row-based apply of generated TIMESTAMP NOT NULL, self-referencing FK deletes); nothing alters binlog wire format, binlog_row_metadata=full, or the GTID semantics that PeerDB MySQL CDC depends on. The two deprecations (group_replication_communication_stack, group_replication_ip_allowlist) and the thread_pool_max_unused_threads default change (2 → 32) do not touch stacks/mysql/my.cnf.sample, so mysqld startup is unaffected. Dropped EL7 support is irrelevant to the container image. This image is dev/test-only (bin_mysql), so blast radius is limited regardless.

node:24-alpine digest — resolves 24.18.0-alpine3.24 → 24.19.0-alpine3.24. Same Alpine base: the previous pin landed 2026-06-29, after Alpine 3.24 became the docker-node default (docker-node#2534, 2026-06-10), so this is a rebuild plus a Node minor, not a hidden Alpine major bump. The range picks up v24.18.1 (2026-07-29), a security release with 11 CVE fixes (HTTP/2 header memory retention, permission-model gaps, DNS large replies, TLS session binding/SNI, SQLite iterator invalidation, zlib overflow) — a net positive. The v24.19.0 additions are purely additive (blob.textStream(), TurboSHAKE/KangarooTwelve, --experimental-import-text, httpValidation, TCP keepalive knobs), with no deprecations or behavior changes affecting the Next.js build or runtime.

_{Non-blocking, pre-existing, and out of scope for this PR: .github/workflows/flow.yml:57 still pins the mysql-gtid matrix entry to a floating mysql:9.5, which now diverges two minors from the dev image.}

[claude]

Reviewed this Renovate bump per .claude/REVIEW.md — no findings.

Digest verification

All three pins resolve to the tags they claim, checked against Docker Hub right now:

Pin	Tag digest today	Result
docker/dockerfile:1.26	sha256:ecfaec9e… (pushed 2026-07-29)	matches
mysql:9.7.2	sha256:257388ed… (pushed 2026-07-28)	matches
node:24-alpine	sha256:d32cdf61… (pushed 2026-08-03)	matches

Upstream changes in the bumped range

docker/dockerfile 1.25 → 1.26 (moby/buildkit dockerfile/1.26.0, 2026-07-29)

The release notes list exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). The rest of the frontend-relevant commits in 1.25.0...1.26.0 are hardening / bug fixes — fileop: contain rm parent traversal, fs: reject special files for ref reads, security: validate exec security modes, dockerfile: fix Windows SBOM scanner temp mount. No Dockerfile syntax or semantic changes, and neither flow.Dockerfile nor peerdb-ui.Dockerfile uses anything affected — the --mount=type=cache usage in both is unchanged in behavior.

Note that stacks/peerdb-server.Dockerfile still pins docker/dockerfile:1@sha256:87999aa3… and was not touched. That is correct rather than a miss: the floating 1 tag upstream is itself still at 87999aa3 (last pushed 2026-05-20).

mysql 9.7.1 → 9.7.2 (release notes, LTS patch)

Nothing that looks like a regression risk for PeerDB. Several fixes land in our favour on the MySQL CDC path:

• SOURCE_RETRY_COUNT=0 now consistently means unlimited reconnects (Bug #39086875)
• Row-based apply no longer fails with Cannot be null on generated TIMESTAMP NOT NULL columns when explicit_defaults_for_timestamp is off (Bug #120128)
• Replication fixes for self-referencing FK deletes, heartbeat handling, binlog rotate events, and binlog transaction compression stats concurrency

The two incompatible changes in the release (EL7 support dropped, thread_pool_max_unused_threads default 2 → 32) do not affect this image. stacks/mysql.Dockerfile is the local dev/test image only; the CI matrix (mysql:9.5) and flow/e2e/test_data/mysql-debug/Dockerfile (8.0.46) are pinned separately and intentionally unchanged.

node:24-alpine digest bump — worth calling out, since Renovate labels it a "digest" update: it is not a rebuild, it is Node 24.18.1 → 24.19.0 (docker-node fd1bf45, v24.19.0, released 2026-08-03), i.e. a semver-minor within the 24 line. The Alpine base is unchanged (alpine:3.23; 3.22 was dropped back in June, well before the previous pin). Changes are additive API surface (blob.textStream(), --experimental-import-text, TCP_KEEPINTVL/TCP_KEEPCNT in setKeepAlive, certificateCompression) plus stricter crypto input validation (rejecting small-order EdDSA points, invalid raw key imports, large DH generator validation) — none of which the Next.js UI build or runtime exercises. No 24.19.1 has been cut in the nine days since release, and the arch-case removals in the upstream Dockerfile only drop x86/armv7/ppc64le, not the x86_64/aarch64 platforms we build.

Other checks

• No new stdout/stderr/log output, and nothing that could surface credentials or PII — the diff is four pinned-image lines. The pre-existing MYSQL_ROOT_PASSWORD placeholder in the mysql.Dockerfile header comment is untouched.
• docker-build is green on this PR; flow_test was still running at review time.

[github-actions]

🔄 Flaky Test Detected

Analysis: TestApiMy/TestTableAdditionWithoutInitialLoad hit the fixed 60s polling deadline in SetupCDCFlowStatusQuery while the mirror was still in STATUS_SETUP — a wall-clock timeout under CI load on a Renovate Dockerfile bump, with the same suite passing on the other two matrix legs.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[github-actions]

🔄 Flaky Test Detected

Analysis: A whole-stack stall on the single maria-12 matrix leg made every MariaDB→ClickHouse test time out (mirrors stuck in STATUS_SETUP, CDC never delivered) until Go's 20m package timeout panicked and marked all 95 in-flight/waiting tests failed, while the other two matrix legs ran the same suites successfully against unchanged service images on a Renovate Dockerfile-bump PR.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[claude]

Reviewed this Renovate bump — no findings, looks clean to merge.

Digest verification. All three pins match what the tags currently resolve to on Docker Hub: docker/dockerfile:1.26 → sha256:ecfaec9e…95fc32 ✅, mysql:9.7.2 → sha256:257388ed…a7ab4e ✅, node:24-alpine → sha256:d32cdf61…e1ad43 ✅.

Upstream changes in the bumped ranges

• docker/dockerfile 1.25 → 1.26 (release, 2026-07-29) — only one notable change, and it is a fix: dockerfile: fix CopyIgnoredFile for context root (#6930), which removes an incorrect lint warning when matching .dockerignore patterns against COPY .. The other frontend-scoped commits in the range are a Windows SBOM scanner temp-mount fix and a docs clarification on WORKDIR tilde behavior. No syntax or semantic changes affecting flow.Dockerfile / peerdb-ui.Dockerfile, and no breaking changes. docker-build is green on this PR.

• mysql 9.7.1 → 9.7.2 (release notes, 2026-07-27) — patch release, no regressions relevant here. Several fixes are actually favourable for binlog-based CDC testing: SOURCE_RETRY_COUNT=0 now consistently means unlimited, a row-based apply fix for TIMESTAMP NOT NULL recomputation, binlog rotate/heartbeat handling fixes, and a BINLOG-with-REPLICATION_APPLIER fix. The behaviour changes in the release (thread_pool_max_unused_threads default 2 → 32, EL7/glibc 2.17 support removal, group_replication_communication_stack / group_replication_ip_allowlist deprecation) do not apply to this image: thread pool is an Enterprise plugin, the image is OL9-based, and no group replication is configured. Every option in stacks/mysql/my.cnf.sample is still valid in 9.7.2. Blast radius is small too — stacks/mysql.Dockerfile is a standalone local-dev helper not referenced by CI (flow.yml uses its own mysql:9.5 matrix entry).

• node:24-alpine digest a0b9bf0 → d32cdf6 — worth flagging since Renovate labels this merely a "digest" update: the rebuild corresponds to nodejs/docker-node@fd1bf45, which bumps Node.js 24.18.1 → 24.19.0, so this is a runtime minor bump rather than a plain rebuild. 24.19.0 is a regular LTS release (not a security release); its changes are semver-minor additions (blob.textStream(), --experimental-import-text, httpValidation, TCP keep-alive options, stream.compose marked stable), with no deprecations or removals that Next.js/npm rely on. That same upstream commit also dropped x86, armv7, ppc64le and s390x from the Node 24 image builds — not an issue here, since docker-bake.hcl only targets linux/amd64 and linux/arm64, both still supported.

No new stdout/stderr/log output is introduced, so this diff adds no PII or secret-exposure surface.

Informational, pre-existing and out of scope for this PR: stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3…, which Renovate did not update here (the PR body notes some dependencies could not be looked up). Tag 1 currently resolves to the same digest as 1.26, so that file will keep building on an older frontend until its pin is refreshed.

[claude]

Renovate review: Update dockerfile dependencies — reviewed, looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing blocking. Details of the upstream-regression check below.

Digest verification

All three pins resolve to the tags they claim on Docker Hub (checked live against the registry):

Pin	Live digest matches
docker/dockerfile:1.26 -> ecfaec9e…	✅
mysql:9.7.2 -> 257388ed…	✅
node:24-alpine -> d32cdf61…	✅

docker/dockerfile 1.25 -> 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

The dockerfile/1.26.0 release notes list a single notable change, and the only non-test source changes under frontend/dockerfile in the 1.25.0…1.26.0 range are:

• moby/buildkit#6930 — fixes a false-positive CopyIgnoredFile warning for COPY . / COPY / when .dockerignore does not actually exclude the context root. Warning-only; no build-semantics change.
• dockerfile: fix Windows SBOM scanner temp mount — Windows-only, not applicable here.
• vendor: migrate to gohugoio/hashstructure in builder/resolvecache.go — internal hashing-lib swap; at worst a one-time frontend resolve-cache miss.
• A WorkdirRelativePath linter doc tweak — every WORKDIR in stacks/*.Dockerfile is absolute, so no new lint warnings.

No new required frontend capabilities and no syntax changes, so no regression risk for these two Dockerfiles. docker-build on this PR passes, which exercises both.

Minor pre-existing note (not this PR): stacks/peerdb-server.Dockerfile is still pinned to docker/dockerfile:1@sha256:87999aa3…, while the 1 tag now resolves to the same digest as 1.26. That stack therefore builds with an older frontend than the other two. Untouched here — flagging only in case the pinning inconsistency is unintentional.

mysql 9.7.1 -> 9.7.2 (stacks/mysql.Dockerfile)

Patch release (2026-07-28). Relevant items from the 9.7.2 release notes:

• The replication fixes are all on the replica/applier side (SOURCE_RETRY_COUNT=0 now consistently unlimited, self-referencing-FK delete replication failure, row-based TIMESTAMP NOT NULL recompute). Nothing changes binlog emission — no row-format, binlog_row_metadata, or GTID changes — which is what PeerDB's MySQL CDC consumes. stacks/mysql/my.cnf.sample (binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode=ON) is unaffected.
• Behavior change: thread_pool_max_unused_threads default 2 -> 32. Irrelevant for a local test image.
• Deprecations: group_replication_communication_stack, group_replication_ip_allowlist — not used in this repo.
• Dropped platform support: Enterprise Linux 7 — n/a for a container base.

Blast radius is small regardless: this image is a local/dev fixture, and CI's flow_test matrix uses mysql:9.5 (.github/workflows/flow.yml).

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)

Renovate labels this digest-only, but the underlying Node version does move — worth knowing rather than a problem:

• old a0b9bf06… = node 24.18.0-alpine3.24
• new d32cdf61… = node 24.19.0-alpine3.24

Same Alpine 3.24 base, so no musl/openssl distro jump (relevant because the base stage runs apk add --no-cache openssl). The delta pulls in:

• v24.18.1 (security release, 2026-07-29) — 11 CVEs including three High: http2 header-memory accounting (CVE-2026-56846), http2 deferred rst-stream (CVE-2026-56848), permission-model radix split nodes (CVE-2026-58043); plus llhttp 9.4.3 and undici 7.29.0. Net security win for the UI runtime.
• v24.19.0 (LTS, semver-minor) — additive APIs only (blob.textStream(), ReadableStreamTee, setKeepAlive TCP options, TLS certificateCompression, etc.). No removals or breaking changes affecting a Next.js 16 build, and ui/package.json declares no engines constraint.

Secrets / PII check

The diff touches only base-image pins — no new stdout/stderr/log output and no credentials. The pre-existing MYSQL_ROOT_PASSWORD=<some password> in the mysql.Dockerfile usage comment is an unchanged placeholder.

One thing to wait on

renovate/stability-days is still pending (minimum release age), so let that settle before automerge lands this.

[claude]

Renovate review: Dockerfile dependency bumps — looks clean ✅

Reviewed per .claude/REVIEW.md. No blocking findings, so no inline comments. Digests verified against Docker Hub, and upstream release notes / commit logs read for each bumped range.

Digest verification

Image	Tag	Digest in PR	Matches Hub
docker/dockerfile	1.26	ecfaec9e…	✅ (= 1.26.0)
mysql	9.7.2	257388ed…	✅ (= 9.7.2-oraclelinux9)
node	24-alpine	d32cdf61…	✅ (= 24.19.0-alpine3.24)

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile:1, stacks/peerdb-ui.Dockerfile:1)

183 commits upstream, but only one is a real Dockerfile-frontend behavior change: moby/buildkit#6930, which fixes a spurious dockerignore warning for COPY . at the context root. The rest is vendor bumps (containerd 2.2.5/2.3.2, runc 1.4.3, x/*, klauspost/compress), CI churn, buildkit-side hardening backported from v0.31.1 (validate exec security modes, limit size of parsed passwd/group files, reject special files for ref reads), and a WorkdirRelativePath lint-rule doc/validation refactor.

No regression exposure here:

• No RUN --security=… anywhere, so the exec-security-mode validation is a no-op for this repo.
• Every WORKDIR in stacks/ is absolute, so the WorkdirRelativePath rule change cannot fire.
• No docker build --check / BUILDKIT_DOCKERFILE_CHECK in CI, so lint changes cannot become build failures.
• --mount=type=cache and ADD --checksum= (both used in flow.Dockerfile) are untouched in this range.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile:4)

Maintenance release (2026-07-28): bug fixes across InnoDB, JSON, optimizer, and replication. Items worth knowing:

• Incompatible change: CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now reserved keywords. Checked the MySQL connector and e2e paths — no unquoted use of these as identifiers, so no impact.
• Deprecated: group_replication_communication_stack, group_replication_ip_allowlist. Neither is referenced in stacks/mysql/my.cnf.sample, which only sets binlog/GTID options — all still valid in 9.7.2.
• Default change thread_pool_max_unused_threads 2 → 32 (Enterprise thread-pool plugin, not applicable), and Enterprise Linux 7 packaging dropped (this image is oraclelinux9).
• The replication fixes target replica/applier behavior rather than binlog-client consumers, so PeerDB MySQL CDC is unaffected.

Blast radius is small: this Dockerfile is only the local convenience image described in its own header. The CI matrix uses upstream mysql:9.5 and mysql:5.7 (.github/workflows/flow.yml:57-58), so CI will not exercise 9.7.2.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile:4)

Renovate classifies this as digest-only, but the new digest is 24.19.0-alpine3.24, so it also rolls the Alpine base forward to 3.24. (The superseded a0b9bf0 digest landed in PR 4514 on 2026-06-29, when 24-alpine tracked Alpine 3.23; that tag has since been rebuilt, so the old digest is no longer resolvable to a tag.) The only package layered on top is openssl, and stacks/flow.Dockerfile:33 is already on alpine:3.24, so this reduces base-image skew across the stacks rather than adding it. Worth confirming the UI build stays green to rule out an openssl version surprise.

Other notes

• No new stdout/stderr/log output, and nothing that could surface passwords, tokens, or PII — the diff is three pinned references.
• Not covered by this PR: stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3…, which resolves to frontend 1.24.0. Because the digest wins over the tag, that image now builds two minors behind the other two. Pre-existing (Renovate tracks the floating 1 tag as a separate entry, and the PR body flags lookup failures against the Dependency Dashboard), so not a change request here — just flagging the drift.

[github-actions]

🔄 Flaky Test Detected

Analysis: TestPeerFlowE2ETestSuiteBQ/Test_Soft_Delete_Basic hit its 3-minute EnvWaitFor deadline waiting for a CDC update to normalize into BigQuery (insert had already succeeded, no BQ/network errors logged), while the same test passed on the other two matrix legs of this Renovate Dockerfile-bump PR — a latency flake, not a regression.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run

[github-actions]

🔄 Flaky Test Detected

Analysis: TestApiPg/TestResyncWithSnapshotConfigOnPausedPipe hit an UNEXPECTED TIMEOUT waiting 3 minutes for the flow to be dropped after termination in only 1 of 3 identical matrix legs, on a Renovate Dockerfile-only PR that cannot affect drop logic — a timing/race timeout rather than a real assertion failure, though the resync→terminate handoff deserves a look if it recurs.
Confidence: 0.78

✅ Automatically retrying the workflow

View workflow run

[claude]

Dependency bump review — reviewed, looks clean ✅

All three digests were verified against the current Docker Hub tag digests, and the upstream release notes / commit ranges were read for each bump. No blocking findings; no changes to stdout/stderr/logging and no secret or PII exposure.

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

• sha256:ecfaec9… matches docker/dockerfile:1.26 (and currently also the floating 1 tag).
• dockerfile/1.26.0 (2026-07-29) lists exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). There are no intermediate frontend releases between 1.25.0 (2026-06-17) and 1.26.0; the rest of the 183-commit range is buildkit core/vendor/CI work that does not ship in the frontend image. No syntax changes, no new minimum BuildKit requirement.
• Neither Dockerfile uses a bare COPY . at context root, so the fixed warning is a no-op here — pure maintenance bump.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

• sha256:257388e… matches mysql:9.7.2 (pushed 2026-07-28).
• 9.7.2 release notes are a bug-fix patch. Behavior changes worth knowing, none of which affect this image's use: thread_pool_max_unused_threads default 2 → 32 (thread pool plugin is Enterprise-only), EL7/glibc 2.17 packaging dropped, group_replication_communication_stack and group_replication_ip_allowlist deprecated, libfido2 → 1.17.0.
• Replication/binlog changes are fixes rather than regression risk: SOURCE_RETRY_COUNT=0 now consistently means unlimited reconnects, crash race on binary_log_transaction_compression_stats, heartbeat/rotate-event handling, row-based apply no longer stopping when recomputing stored TIMESTAMP from NULL, self-referencing FK delete replication failure. Nothing conflicts with stacks/mysql/my.cnf.sample (log_bin=ON, binlog_format=ROW, binlog_row_metadata=full, GTID on).
• Blast radius is local dev only: this image is a standalone helper (built manually per the header comment; not referenced by docker-compose*.yml, Tiltfile, docker-bake.hcl or CI). CI MySQL coverage stays on mysql:9.5 (.github/workflows/flow.yml) and the pinned 8.0 mysql-debug fixture.

node:24-alpine digest a0b9bf0 → d32cdf6 (stacks/peerdb-ui.Dockerfile)

• The new digest resolves to 24.19.0-alpine3.24. The previous digest was pinned on 2026-06-29 (Update dockerfile dependencies #4514), when 24-alpine mapped to 24.18.0-alpine3.24 per docker-library/official-images at that date — so the Alpine series is unchanged (3.24), no musl/OpenSSL major shift under the apk add openssl in the base stage.
• The bump rolls up the 24.18.1 security release (2026-07-29: HTTP/2 header memory accounting, permission-model radix-tree grants, HTTPS agent key distinction, DNS large address replies, Buffer write validation) plus 24.19.0 additions (blob.textStream(), ReadableStreamTee, TLS group negotiation reporting). Still within Node 24 LTS; the repo has no engines field or .nvmrc to keep in sync.

Non-blocking observation (pre-existing, not introduced here)

stacks/peerdb-server.Dockerfile:1 still pins docker/dockerfile:1@sha256:87999aa…, which is frontend 1.24.0, while the 1 tag now resolves to 1.26. Nothing breaks (the digest pin is what is used), but the repo builds with two different frontend versions until Renovate's separate digest PR for that tag lands.

CI

docker-build, CodeQL, lint and migration checks are green; the flow_test e2e matrix was still running at review time.

[claude]

Renovate bump review — clean ✅

Reviewed per .claude/REVIEW.md. No secret/PII exposure surface (no logging, stdout/stderr, or credential handling touched), and no regressions found in the bumped ranges. All three digests were verified against the registry.

docker/dockerfile syntax 1.25 → 1.26 (flow.Dockerfile, peerdb-ui.Dockerfile)

• Digest ecfaec9e… matches docker/dockerfile:1.26 on Docker Hub (pushed 2026-07-29); frontend release dockerfile/1.26.0 published the same day.
• Sole notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). I read the diff — it only adds a copySourceRootIgnored guard in dockerfile2llb/validations.go so the CopyIgnoredFile lint warning is suppressed for context-root sources. No change to emitted LLB, so build output is unaffected.
• Everything else in the 1.25.0…1.26.0 range is BuildKit-daemon-side (exporters, solver, vendoring) and is not shipped by the # syntax= frontend image. Notably exporter: default attestations to OCI artifacts does not come along with this pin.
• No syntax deprecations or removals. Both Dockerfiles only use long-stable features (RUN --mount=type=cache, ADD --checksum, COPY --chown/--from), nothing labs-gated.

mysql 9.7.1 → 9.7.2 (mysql.Dockerfile)

• Digest 257388ed… matches mysql:9.7.2 (pushed 2026-07-28). Release notes (2026-07-28).
• Behavior changes screened against stacks/mysql/my.cnf.sample, none apply:
  • thread_pool_max_unused_threads default 2 → 32 — the thread pool plugin isn't loaded here.
  • group_replication_communication_stack / group_replication_ip_allowlist deprecated — not used.
  • Enterprise Linux 7 support dropped — irrelevant to this image.
• Replication changes in the range are all bug fixes (SOURCE_RETRY_COUNT=0 retry handling, generated TIMESTAMP NOT NULL apply, self-referencing FK deletes, binlog compression stats crash). Nothing alters binlog_format=ROW / binlog_row_image / binlog_row_metadata / GTID semantics that the MySQL CDC connector depends on.
• Blast radius is small: stacks/mysql.Dockerfile is a manual dev helper (per its own header comment) and isn't referenced anywhere else in the repo — flow_test builds its MySQL from the matrix in .github/workflows/flow.yml.

node:24-alpine digest a0b9bf0 → d32cdf6 (peerdb-ui.Dockerfile)

• Resolves to 24.18.0-alpine3.24 → 24.19.0-alpine3.24. The Alpine base stays on 3.24, so no musl/openssl base change.
• This crosses v24.18.1, a security release fixing 11 CVEs, including three high-severity ones: CVE-2026-56846 (HTTP/2 header memory retention), CVE-2026-56848 (HTTP/2 reset stream handling), CVE-2026-58043 (permission system radix split node). Worth landing for that reason alone.
• v24.19.0 is semver-minor and purely additive (blob.textStream(), --experimental-import-text, httpValidation option, TLS certificateCompression, caller-supplied readFile buffers, ReadableStreamTee). Nothing removed or behavior-changing for the Next.js build/runtime.

Non-blocking note (pre-existing, outside this diff)

stacks/peerdb-server.Dockerfile:1 still pins # syntax=docker/dockerfile:1@sha256:87999aa3…, which is the 1.24 digest — it hasn't advanced since #4514, while the other two Dockerfiles have gone 1.24 → 1.25 → 1.26. Because it uses the floating 1 tag rather than a pinned minor, Renovate isn't proposing a digest refresh for it (plausibly the "Some dependencies could not be looked up" warning in this PR body). Not introduced here, but the three Dockerfiles now build with two different frontend versions — may be worth aligning separately.

[claude]

Dependency bump review — clean ✅

Reviewed all three bumps against upstream release notes and verified the pinned digests resolve to the claimed tags on Docker Hub.

Digest verification

Pin	Live digest for tag	Result
docker/dockerfile:1.26@sha256:ecfaec9e…	sha256:ecfaec9ed6d810b5…	✅ match
mysql:9.7.2@sha256:257388ed…	sha256:257388edf9c84dbc…	✅ match
node:24-alpine@sha256:d32cdf61…	sha256:d32cdf619f63fe04…	✅ match

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

The only frontend behavior change in dockerfile/1.26.0 is a bug fix: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). The rest of the range is dependency/vendor updates (containerd v2.2.5, golang.org/x/*) and CI plumbing. No syntax or semantic changes affecting the features these Dockerfiles use (--mount=type=cache, ADD --checksum, multi-stage targets). No regression risk.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

MySQL 9.7.2 (2026-07-28) is a bugfix release. Relevant to PeerDB's MySQL CDC source, several fixes are actually favorable:

• Deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #39091367)
• Row-based apply of stored generated TIMESTAMP NOT NULL columns fixed when explicit_defaults_for_timestamp=OFF (Bug #39182574)
• binary_log_transaction_compression_stats concurrency crash fixed (Bug #36196212); heartbeat and event-rotate handling fixes

Behavior changes worth knowing (checked, none affect this repo):

• CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now reserved keywords (MANUAL/PARALLEL became non-reserved). Grepped the MySQL connector and e2e suites — no unquoted identifiers collide. The only QUALIFY in the tree is Snowflake SQL (flow/connectors/snowflake/qrep_avro_consolidate.go:200), unaffected.
• thread_pool_max_unused_threads default 2 → 32 (Enterprise thread pool plugin only, not used here).
• EL7 dropped upstream — irrelevant to the container image.

Note this image is dev/Tilt-only; CI's flow_test matrix pins mysql:9.5, so the blast radius is local development.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)

Renovate labels this a digest-only update, but it is materially a Node 24.18.0 → 24.19.0 move (old digest = 24.18.0-alpine3.24, new digest = 24.19.0-alpine3.24; Alpine base unchanged at 3.24, consistent with alpine:3.24 in flow.Dockerfile).

24.19.0 rolls up the 24.18.1 security release, which fixes several High-severity CVEs — HTTP/2 header memory retention in session accounting (CVE-2026-56846), HTTP/2 RST stream handling (CVE-2026-56848), permission-model radix split nodes (CVE-2026-58043) — plus Medium/Low fixes in HTTPS session reuse, SQLite, DNS resolveAny, and zlib. Semver-minor within the LTS line; docker-build is green.

Other checks

• No new stdout/stderr/log output; no credentials, tokens, or PII introduced. The only secret-adjacent line in the diff's neighborhood is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder comment in mysql.Dockerfile, which is a documentation placeholder, not a real value.
• Minor pre-existing inconsistency (not introduced here, no action needed): stacks/peerdb-server.Dockerfile still pins docker/dockerfile:1@sha256:87999aa3…, while the 1 tag now resolves to the same digest as 1.26. Renovate tracks that pin separately and should catch it up on its own.

No regressions found — good to merge once the remaining checks and the stability-days gate pass.

[github-actions]

🔄 Flaky Test Detected

Analysis: All 9 failures on the single failing matrix leg are ~61s "UNEXPECTED STATUS TIMEOUT" waits on mirrors stuck in STATUS_SETUP/STATUS_SNAPSHOT across four unrelated suites, while the other two matrix legs passed on the same commit and all core services reported healthy — indicating runner-level stall/contention rather than a bug in this Renovate Dockerfile bump.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[claude]

Reviewed this Renovate bump against .claude/REVIEW.md. No findings — looks clean to merge.

Digest verification

All three pinned digests match what the tags currently resolve to on Docker Hub (no tag/digest mismatch):

Image	Tag	Digest in PR	Registry
docker/dockerfile	1.26	ecfaec9e…	✅ match (pushed 2026-07-29)
mysql	9.7.2	257388ed…	✅ match (pushed 2026-07-28)
node	24-alpine	d32cdf61…	✅ match (pushed 2026-08-03)

Upstream release notes for the bumped range

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)
The range spans exactly dockerfile/1.25.0 → dockerfile/1.26.0 (no intermediate patch releases exist). The only documented change is moby/buildkit#6930 — fix an incorrect warning when matching .dockerignore patterns against COPY .. No syntax, semantics, or minimum-BuildKit-version changes. No regression risk.

Side note: stacks/peerdb-server.Dockerfile is pinned to the floating docker/dockerfile:1 rather than a pinned minor, so it is not updated in lockstep here. Pre-existing, out of scope for this PR.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)
MySQL 9.7.2 release notes (2026-07-28) is a bugfix-only release. Reviewed for anything touching the CDC surface:

• Several replication fixes land in our favour, notably deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #119996), row-based apply no longer fails on generated TIMESTAMP NOT NULL columns (Bug #120128), and SOURCE_RETRY_COUNT=0 is now consistently treated as unlimited.
• Deprecations are group_replication_communication_stack / group_replication_ip_allowlist — neither appears in stacks/mysql/my.cnf.sample.
• Changed default: thread_pool_max_unused_threads 2 → 32. Thread pool is not loaded in this image, so no effect.
• Dropped Enterprise Linux 7 packaging support — irrelevant to the container image.
• Nothing changes binlog format, binlog_row_metadata, or GTID behaviour, so my.cnf.sample stays valid as-is.

Worth noting for scope: this Dockerfile is a local/dev helper only. CI e2e runs pin mysql:9.5 and mysql:5.7 directly in .github/workflows/flow.yml, so this bump does not shift the tested MySQL matrix.

node:24-alpine digest bump (stacks/peerdb-ui.Dockerfile)
Tag stays 24-alpine, so the major line is unchanged. The 2026-08-03 push date lines up with Node v24.19.0 (LTS Krypton, npm 11.17.0), moving off the previous 24.18.1. v24.19.0 is a non-security release consisting of additive SEMVER-MINOR changes (blob.textStream(), caller-supplied readFile() buffers, --experimental-import-text, TLS certificate compression, dgram sync bind/connect). No removals or behaviour changes that affect the UI build; the repo declares no engines constraint or .nvmrc that could conflict.

Other review criteria

No new stdout/stderr/log output is introduced, so no PII or secret-exposure risk. The MYSQL_ROOT_PASSWORD=<some password> string in the mysql.Dockerfile header is a pre-existing usage-comment placeholder, not a real credential.

[claude]

Renovate review: Update dockerfile dependencies — reviewed, looks clean ✅

No findings. Digests verified and upstream changes for each bumped range reviewed per .claude/REVIEW.md.

Digest verification (resolved against Docker Hub)

Pin	Tag digest today	Match
docker/dockerfile:1.26	sha256:ecfaec9e…95fc32	✅
mysql:9.7.2	sha256:257388ed…a7ab4e	✅
node:24-alpine	sha256:d32cdf61…e1ad43	✅

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)

Frontend release notes for dockerfile/1.26.0 list a single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930). Diffing dockerfile/1.25.0...dockerfile/1.26.0, the only non-test changes under frontend/dockerfile/ are builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go, version/version.go and linter docs — no syntax/semantic changes affecting our directives (--mount=type=cache, COPY --chown, multi-stage, build args). No regression risk identified.

Note: exporter: default attestations to OCI artifacts also landed in that commit range, but that is a BuildKit daemon/exporter change, not part of the frontend the # syntax= line pins, so it is not pulled in by this bump.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

Routine patch on the 9.7 LTS line (docker-library/mysql, 2026-07-27). Release notes are net-positive for our MySQL CDC path — several binlog/replication fixes (SOURCE_RETRY_COUNT=0 now consistently treated as unlimited reconnects, row-based apply with TIMESTAMP NOT NULL, binary_log_transaction_compression_stats race, event-rotate/heartbeat handling) plus InnoDB AUTO_INCREMENT and unique-index fixes.

Checked the two behavior changes for impact and both are non-issues here:

• thread_pool_max_unused_threads default 2 → 32 — thread pool plugin isn't enabled in stacks/mysql/my.cnf.sample.
• Enterprise Linux 7 support dropped — irrelevant to the container image.
• CUBE/EXTERNAL/QUALIFY/TABLESAMPLE are now properly reserved keywords — grepped flow/connectors/mysql and flow/e2e/mysql for those identifiers, no hits.

Blast radius is also small: stacks/mysql.Dockerfile is a dev-only helper (per its own header comment) and isn't referenced by any compose file, Tiltfile, workflow, or Go test. CI's MySQL service uses mysql:9.5 (.github/workflows/flow.yml:57) and the e2e debug image pins 8.0.46 — both untouched and unaffected.

node:24-alpine digest (stacks/peerdb-ui.Dockerfile)

Renovate labels this digest-only, but the tag moved Node 24.18.0 → 24.19.0. The previous digest was pinned in #4514 (2026-06-29, 24.18.0 era); 24-alpine now resolves to NODE_VERSION=24.19.0 on alpine:3.24.

This is a security-relevant bump: it rolls up 24.18.1 (2026-07-29), which fixed 11 CVEs including high-severity HTTP/2 header memory retention / RST-stream handling and a permission-model radix tree issue, and updated llhttp 9.4.3 / undici 7.29.0. 24.19.0 itself is semver-minor LTS (new blob.textStream(), TurboSHAKE/KangarooTwelve WebCrypto, --experimental-import-text, etc.) with no breaking changes. Alpine base line is unchanged from the previous pin (3.24), so apk add openssl in the base stage is unaffected.

No PII/secret output is added anywhere in this diff.

Unrelated FYI (pre-existing, not introduced here)

stacks/peerdb-server.Dockerfile:1 pins docker/dockerfile:1@sha256:87999aa3… — that digest is the 1.24 frontend, so it's two minors behind. Because it uses the floating :1 tag instead of :1.25/:1.26, Renovate tracks it as a separate dependency and this PR doesn't touch it. Might be worth aligning it to 1.26 so all three images build with the same frontend.

[claude]

Renovate bump review — clean ✅

Reviewed all 4 changed lines in stacks/*.Dockerfile. No findings; nothing blocking.

Digest verification

All four pins were checked against Docker Hub and resolve correctly:

Ref	Pinned digest	Registry
docker/dockerfile:1.26	ecfaec9…	✅ match
docker/dockerfile:1	ecfaec9…	✅ match (tag 1 currently resolves to 1.26.0, so both styles in this repo stay in sync)
mysql:9.7.2	257388e…	✅ match
node:24-alpine	d32cdf6…	✅ match (= 24.19.0-alpine3.24)

Upstream review of the bumped ranges

docker/dockerfile 1.25 → 1.26 (moby/buildkit dockerfile/1.26.0, released 2026-07-29)

• Single notable frontend change: #6930 — fixes a spurious warning when matching .dockerignore patterns against COPY .. Warning-only, no build-semantics change.
• The rest of the dockerfile/1.25.0…1.26.0 commit range is daemon-side (solver locking/race fixes, WCOW mounts, exporter/cache changes) and vendored dep bumps — none of that ships in the syntax= frontend image, so it does not affect these builds.
• No breaking changes, no deprecations, no new minimum-BuildKit requirement. None of the three Dockerfiles use syntax affected by the change.
• Note: peerdb-server.Dockerfile was still on the 1.24 digest (87999aa), so it actually moves 1.24 → 1.26. The only 1.25 notable was opt-in per-RUN CPU/memory limits (#6569) — not used here, so nothing to worry about. Side benefit: all three Dockerfiles now converge on the same frontend digest.

mysql 9.7.1 → 9.7.2 (release notes)

• Bugfix-only patch. Several fixes are directionally good for a CDC product: SOURCE_RETRY_COUNT=0 no longer stops the receiver after a transient disconnect (Bug 39086875), row-based apply fix for TIMESTAMP NOT NULL with explicit_defaults_for_timestamp off (Bug 39182574), self-referencing-FK delete replication fix (Bug 39091367), plus binlog heartbeat/rotate-event fixes.
• Incompatible changes are packaging/Group-Replication only: EL7 support dropped, and group_replication_communication_stack / group_replication_ip_allowlist deprecated. Neither applies here.
• Behavioural default change to be aware of: thread_pool_max_unused_threads 2 → 32 (Bug 39405207). Thread pool is an Enterprise plugin, so no effect on this image.
• Blast radius is small regardless: stacks/mysql.Dockerfile is a local dev helper only — it is not referenced by .github/workflows/flow.yml (CI uses mysql:9.5 / mysql:5.7) or any compose stack.

node:24-alpine digest a0b9bf0 → d32cdf6

• This is Node 24.18.0 → 24.19.0 on the same Alpine 3.24 base (the 3.23 → 3.24 default move already landed before the previous bump in Update dockerfile dependencies #4514), so no base-OS jump and no musl/openssl major change.
• The range crosses v24.18.1, a security release fixing 11 CVEs — three High (CVE-2026-56846, CVE-2026-56848 http2; CVE-2026-58043 permission model) plus http/https/dns/zlib/sqlite issues, and pulls in llhttp 9.4.3 / undici 7.29.0. Worth taking.
• v24.19.0 is a normal LTS minor (additive SEMVER-MINOR APIs, npm 11.17.0, sqlite 3.53.3). Nothing removed or behaviour-changing for a Next.js standalone build.

Other checks

• No new stdout/stderr/log output, and no PII or secrets introduced. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing usage-comment placeholder, not a credential.
• docker-build is already green on this PR.

[claude]

Dependency bump review — clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing to comment on inline.

Digest verification

All four pins resolve to the tags they claim (checked against Docker Hub):

Pin	Tag resolves to	✓
docker/dockerfile:1.26	sha256:ecfaec9e…	✅
docker/dockerfile:1	sha256:ecfaec9e… (same image)	✅
mysql:9.7.2	sha256:257388ed…	✅
node:24-alpine	sha256:d32cdf61…	✅

Side benefit: before this PR peerdb-server.Dockerfile was on a different frontend digest (87999aa) than flow/peerdb-ui (0adf442). All three now converge on the same 1.26.0 frontend.

Upstream release notes / commit log

docker/dockerfile 1.25 → 1.26 (dockerfile/1.26.0, released 2026-07-29 alongside BuildKit v0.32.0)

The only notable change called out upstream is "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). I diffed frontend/dockerfile/ between the two tags — apart from tests and docs, the only non-Windows source change is that fix in dockerfile2llb/validations.go, which suppresses the CopyIgnoredFile lint warning for context-root copies unless a root-level * / ** / **/* pattern exists. Our .dockerignore has no such pattern, so this is a no-op for COPY flow . and COPY --chown=node:node ui/ .. The remaining frontend commit (dockerfile: fix Windows SBOM scanner temp mount) is Windows-only.

Worth noting explicitly, since it looks alarming in the v0.32.x log: exporter: default attestations to OCI artifacts (#6914) — later worked around in v0.32.1 and reverted in v0.32.2 — lives in exporter/containerimage and control/, i.e. buildkitd, not the frontend image the # syntax= directive pulls. Bumping the syntax pin does not pick it up. Same for the solver/ race fixes and the s3-cache changes. No dockerfile/1.26.1 exists, and I found no open regression reports against the 1.26 frontend.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Patch release, mostly replication-applier and JSON fixes. I checked specifically for anything that could affect our MySQL CDC (binlog reader, GTID): nothing changes binlog event format or GTID semantics. The one replication fix that touches row events (Bug #120128 — TIMESTAMP NOT NULL recompute with explicit_defaults_for_timestamp disabled) is on the apply / mysqlbinlog replay path, which we do not use. Behaviour changes in the release — thread_pool_max_unused_threads default 2 → 32 (thread pool plugin, not in Community) and dropping Enterprise Linux 7 support (image is EL9-based) — are both inert here.

Also: stacks/mysql.Dockerfile is a standalone local dev convenience image (its own header documents docker build -f mysql.Dockerfile); nothing in docker-bake.hcl, the Tiltfile, or the CI matrix consumes it, so this bump does not touch test coverage. The e2e MySQL matrix (mysql:9.5) and the mysql-debug fixture (8.0.46, deliberately pinned by a renovate.json5 rule) are untouched, as intended.

node:24-alpine digest bump — NODE_VERSION 24.18.1 → 24.19.0 (confirmed via docker-library/repo-info), same Alpine base. Routine LTS Krypton minor: all additive semver-minor APIs (blob.textStream(), --experimental-import-text, httpValidation, TLS certificateCompression, etc.). Nothing removed or changed that the Next.js build or server.js runtime depends on, and ui/package.json declares no engines constraint. Note this also carries forward the 24.18.1 security release (CVE-2026-56846 … CVE-2026-58045).

Other checks

• No new stdout/stderr/log output, and no secrets, tokens, or PII introduced. The only credential-adjacent text is the pre-existing MYSQL_ROOT_PASSWORD=<some password> placeholder in the mysql.Dockerfile usage comment — a placeholder, not a real value.
• renovate/stability-days is currently pending ("minimum release age"). That is Renovate own automerge gate and should clear on its next run; it is not a problem with the change itself.

[claude]

🤖 Automated dependency review

Reviewed per .claude/REVIEW.md. No blocking findings — this bump looks clean.

Digest verification

All four pins were resolved against Docker Hub and match what the diff claims:

Pin	Digest in PR	Registry says	✔
docker/dockerfile:1.26	ecfaec9…	ecfaec9… (2026-07-29)	✅
docker/dockerfile:1	ecfaec9…	ecfaec9…	✅
mysql:9.7.2	257388e…	257388e… (2026-07-28)	✅
node:24-alpine	d32cdf6…	d32cdf6… (2026-08-03)	✅

docker/dockerfile:1 and :1.26 resolve to the same image, so peerdb-server.Dockerfile and flow.Dockerfile/peerdb-ui.Dockerfile stay in sync despite the different tag spellings.

Upstream release notes — regression check

docker/dockerfile 1.25 → 1.26 (release notes; 183 commits in dockerfile/1.25.0...dockerfile/1.26.0)

The only frontend-visible change is a bug fix: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930) — warning-only, and none of our Dockerfiles use COPY . at the context root anyway. Everything else in the range is BuildKit daemon/CI/vendor work (containerd, golang.org/x/*, solver locking, OCI attestation defaults) which the syntax= directive does not pull in. No breaking changes, no removed directives. Features we rely on — ADD --checksum= (flow.Dockerfile:35) and RUN --mount=type=cache with uid/gid (peerdb-ui.Dockerfile:18) — are unaffected.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Patch release, bug fixes only. Nothing touches the options in stacks/mysql/my.cnf.sample (binlog_format=ROW, binlog_row_image/binlog_row_metadata=full, gtid_mode=ON) — no deprecations or removals there. A couple of the fixes are actually favourable for CDC: deleting a row from a table with a self-referencing FK no longer breaks replication (Bug #39091367), and a LOAD DATA bug that left stale NULL state on table fields is fixed (Bug #38939847). The deprecations in this release are group_replication_communication_stack / group_replication_ip_allowlist — unused here. Note this image is a standalone dev helper (not referenced from docker-compose-dev.yml, the Tiltfile, or CI), so blast radius is minimal; the MySQL matrix pins in .github/workflows/flow.yml are separate and untouched.

node:24-alpine digest bump

Same tag, rebuilt 2026-08-03 — routine Node 24 LTS patch plus Alpine base security updates. No major-version movement, so npm ci / next build are unaffected.

Secrets / PII (REVIEW.md rule 1)

No new logging, stdout/stderr output, or credential handling introduced. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing placeholder in a usage comment, not a real value.

_{Non-blocking nit, pre-existing: peerdb-server.Dockerfile pins the syntax tag as :1 while the other two use :1.26, which makes Renovate track them as two separate update streams (one "digest", one "minor"). Harmless today since they resolve identically, but unifying on :1.26 would keep future bumps in a single stream.}

[github-actions]

🔄 Flaky Test Detected

Analysis: Timing-dependent duplicate emission in the brand-new TestCockroachDBSuite/Test_CDC_Exactly_Once_Across_Batches — the connector deliberately emits buffered records past the checkpoint when resolved timestamps stall beyond IdleTimeout+2s (cdc.go:489), which a loaded CI runner easily triggers; the other two CockroachDB matrix legs passed on identical code and the PR is a Renovate Dockerfile bump touching no Go code.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[claude]

Renovate dependency bump review — no findings

Reviewed per .claude/REVIEW.md. This is a 4-file, Dockerfile-only change (+5/-5). No new logging, stdout/stderr output, or anything that could leak secrets/PII was introduced.

Digest verification (all confirmed against Docker Hub)

Image	Change	Resolved digest matches tag
docker/dockerfile:1.26	1.25 → 1.26 (0adf442 → ecfaec9)	✅
docker/dockerfile:1	87999aa → ecfaec9	✅ (tag 1 currently resolves to the same 1.26 index)
mysql:9.7.2	9.7.1 → 9.7.2	✅
node:24-alpine	a0b9bf0 → d32cdf6	✅ (= Node 24.19.0 on Alpine 3.24)

Regression assessment

docker/dockerfile 1.25.0 → 1.26.0 (release, 183-commit range)

The syntax= directive only swaps the Dockerfile frontend, not buildkitd, so only the frontend-facing changes in the range matter. Non-test source changes under frontend/dockerfile are limited to:

• dockerfile: fix CopyIgnoredFile for context root (dockerfile: fix CopyIgnoredFile for context root moby/buildkit#6930) — the sole item in the release notes; fixes a spurious lint warning when matching .dockerignore patterns against COPY .. None of our four Dockerfiles use a bare COPY . at context root (flow.Dockerfile uses COPY flow ., the UI uses COPY --chown=node:node ui/ .), so this is a no-op here.
• dockerfile: fix Windows SBOM scanner temp mount — Windows/WCOW only.
• docs: clarify WORKDIR tilde path behavior + linter doc — docs only; no Dockerfile here uses a tilde WORKDIR.
• dockerfile: use containerd defaults for the gRPC max recv/send message size — replaces hardcoded constants with containerd defaults; no behavioral change at our scale.

The rest of the range is buildkitd-side (solver/exporter/executor) and does not ship with the frontend image — notably exporter: default attestations to OCI artifacts and the WCOW cache-mount hardening, which are daemon behaviors and unaffected by this bump. The range also carries the v0.31.1/v0.31.2 security patches (exec security-mode validation, passwd/group parse limits, fileop rm parent-traversal containment, git bundle ref validation, LLB input-index validation) — all daemon-side, but a good reason to be on the newer line.

No open buildkit issues report a 1.26 frontend regression. The features these Dockerfiles rely on — RUN --mount=type=cache, ADD --checksum, multi-stage COPY --from, ARG/ENV — are unchanged in the range. docker-build (ubuntu-latest) already passes on this PR.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Maintenance release: X Plugin and Clone plugin fixes, optimizer fixes (subquery_to_derived, ROLLUP, decimal aggregation error handling, CTEs, ExtractValue()), an audit_log_encryption_password_get() crash fix, libfido2 → 1.17.0, and thread_pool_max_unused_threads default 2 → 32. Deprecates group_replication_communication_stack and group_replication_ip_allowlist — neither is used here. Nothing touches binlog/GTID semantics that the PeerDB MySQL CDC connector depends on. Additionally, stacks/mysql.Dockerfile is a manual dev helper — it is not referenced by any workflow or the Tiltfile (CI provisions MySQL from mysql:9.5 in .github/workflows/flow.yml), so blast radius is limited to local use.

node:24-alpine digest — rebuild landing Node 24.19.0 / Alpine 3.24 on the LTS line. Same major, the ui/ build is unaffected.

Notes (non-blocking, pre-existing)

• stacks/peerdb-server.Dockerfile pins the floating docker/dockerfile:1 tag while flow.Dockerfile and peerdb-ui.Dockerfile pin 1.26. All three currently resolve to the same digest, so they stay in lockstep for now, but the tags will drift apart at the next minor. Worth normalizing if you want the three builds to move together.
• renovate/stability-days is still pending (minimum release age not yet met), and the flow_test matrix jobs were still running at review time — automerge will gate on those.

Verdict: clean, safe to merge once CI is green.

[github-actions]

🔄 Flaky Test Detected

Analysis: All four failures are BigQuery normalize WaitFor timeouts clustered in a ~1-minute window across two independent matrix jobs, while the pg16 job passed the identical BQ suite on the same commit — a transient BigQuery latency issue on a Dockerfile-only Renovate PR, not a code bug.
Confidence: 0.92

✅ Automatically retrying the workflow

View workflow run

[github-actions]

🔄 Flaky Test Detected

Analysis: A Renovate Dockerfile-only PR failed with a rotating subset of BigQuery e2e tests hitting 180s "UNEXPECTED TIMEOUT" waiting for normalization (different tests on attempt 1 vs attempt 2, and the same tests passed in a parallel matrix leg on the same commit), indicating transient BigQuery/runner contention rather than a real bug.
Confidence: 0.9

✅ Automatically retrying the workflow

View workflow run

[claude]

Reviewed this Renovate bump per .claude/REVIEW.md — no findings, looks clean.

Digest verification

All four pins resolve to the current Docker Hub digest for their tag (checked against hub.docker.com/v2/repositories/...):

Ref	Pinned digest	Registry says	Tag last pushed
docker/dockerfile:1.26	ecfaec9…	✅ match	2026-07-29
docker/dockerfile:1	ecfaec9…	✅ match	2026-08-12
mysql:9.7.2	257388e…	✅ match	2026-07-28
node:24-alpine	d32cdf6…	✅ match	2026-08-03

Side benefit: stacks/peerdb-server.Dockerfile pins docker/dockerfile:1 while flow.Dockerfile / peerdb-ui.Dockerfile pin 1.25→1.26. Before this PR those were two different digests (87999aa vs 0adf442), i.e. the server image was built with a different frontend than the others. They now converge on ecfaec9, so all three Dockerfiles build with the same frontend.

Upstream release notes for the bumped ranges

docker/dockerfile 1.25 → 1.26 (dockerfile/1.26.0, 2026-07-29)
Single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY . command" (moby/buildkit#6930). No syntax additions, no behavior changes, no minimum-BuildKit bump. peerdb-ui.Dockerfile is the only one using frontend-specific features here (RUN --mount=type=cache), which is unaffected. Regression risk: negligible.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)
Pure bugfix patch. Nothing that regresses PeerDB's MySQL CDC path — the replication-adjacent entries are all fixes in our favor:

• Deleting a row from a table with a self-referencing FK caused replication to fail (fixed).
• Fixes to binlog event rotate handling (Bug #39253359) and heartbeat handling (Bug #39377010) — both directly on the binlog-reader path.
• Row-based apply no longer stops on a stored generated TIMESTAMP NOT NULL recomputed from NULL when explicit_defaults_for_timestamp is off (Bug #39182574).
• Deprecations are group_replication_communication_stack / group_replication_ip_allowlist — unused here.
• Packaging drops Enterprise Linux 7 support; the image is EL9-based, so no impact.

Note this Dockerfile is the local/dev MySQL image only — the CI matrix pins its own versions (mysql:9.5, etc.) and flow/e2e/test_data/mysql-debug/Dockerfile stays on 8.0.46, so neither is affected.

node:24-alpine digest bump → Node v24.19.0 (2026-08-03, Krypton LTS), up from the pre-24.19 24.x build.
All notable changes are SEMVER-MINOR additions (blob.textStream(), --experimental-import-text, caller-supplied fs.readFile() buffers, TCP_KEEPINTVL/TCP_KEEPCNT, TLS certificateCompression, stream.compose marked stable). No SEMVER-MAJOR entries, no removals or behavior changes, and it rolls up the 24.18.1 patch. Nothing that affects the npm ci + next build + standalone-runner flow in peerdb-ui.Dockerfile.

Other checks

• No new stdout/stderr/log output, and nothing touching passwords, tokens or other secrets — the MYSQL_ROOT_PASSWORD reference in stacks/mysql.Dockerfile is an unchanged usage comment with a <some password> placeholder.
• docker-build (ubuntu-latest) is green, so the new frontend and base images build. renovate/stability-days is still pending (minimum release age), which is expected and will clear on its own before automerge.

[claude]

Reviewed this Renovate bump per .claude/REVIEW.md (secret/PII exposure + upstream regression check). No findings — looks clean.

Digest verification

All four pins were verified against Docker Hub; every digest matches the tag it claims:

Pin	Tag resolves to
docker/dockerfile:1.26@sha256:ecfaec9…	✅ 1.26 / 1.26.0 (pushed 2026-07-29)
docker/dockerfile:1@sha256:ecfaec9…	✅ 1 (same index digest as 1.26.0)
mysql:9.7.2@sha256:257388e…	✅ 9.7.2 (pushed 2026-07-28)
node:24-alpine@sha256:d32cdf6…	✅ 24.19.0-alpine3.24 (pushed 2026-08-03)

Upstream release notes / regression check

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile)
Sole notable change in dockerfile/1.26.0 is moby/buildkit#6930 — fixes an incorrect warning when matching dockerignore patterns against COPY .. Purely a false-positive fix; no syntax or semantic changes. Everything else in the 1.25.0...1.26.0 range is buildkit-daemon/vendor work that does not ship in the frontend image.

docker/dockerfile 1 tag: 1.24 digest → 1.26 digest (stacks/peerdb-server.Dockerfile)
Worth calling out: this file was pinned to the 1 tag but still carrying the 1.24 digest (87999aa, the same digest flow/ui had before #4514), so it effectively jumps two minors. The only additional change from dockerfile/1.25.0 is opt-in CPU/memory resource limits for RUN steps (moby/buildkit#6569, requires BuildKit v0.31.0+). It is only active when the client passes the option, so it imposes no new builder requirement — and this Dockerfile uses only standard RUN --mount=type=cache / multi-stage features that are unchanged. The docker-build (ubuntu-latest) job passes, which exercises this path.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)
Release notes (2026-07-28) — no regressions relevant here:

• Behaviour changes are thread_pool_max_unused_threads 2 → 32 (Enterprise thread-pool plugin, not in the community image) and dropping Enterprise Linux 7 support (N/A for the container).
• Deprecations are group_replication_communication_stack / group_replication_ip_allowlist; neither appears in stacks/mysql/my.cnf.sample, which only sets binlog/GTID options that are unchanged in 9.7.2.
• The binlog/replication fixes are net-positive for PeerDB MySQL CDC (SOURCE_RETRY_COUNT=0 race, rotate/heartbeat handling, ALTER USER with empty auth data being rewritten into the binlog, row-apply failures on self-referencing FKs and on recomputed TIMESTAMP NOT NULL).
• This image is a local dev helper only — nothing in CI, compose, or the e2e harness references it (flow/e2e/test_data/mysql-debug/Dockerfile takes MYSQL_VERSION as a build arg), so blast radius is limited.

node 24.18.x-alpine3.24 → 24.19.0-alpine3.24 (stacks/peerdb-ui.Dockerfile)
v24.19.0 (2026-08-03) is a regular LTS minor, not a security release, no CVEs. All notable entries are additive/experimental (blob.textStream(), --experimental-import-text, fs.readFile() caller-supplied buffers, httpValidation, TLS certificateCompression, stream.compose stabilised). Alpine base stays at 3.24, so apk add openssl and the node uid/gid 1000 cache-mount assumptions in the UI build are unaffected.

Secrets / PII

No changes to logging or stdout/stderr output. The only credential-adjacent line anywhere near the diff is the pre-existing MYSQL_ROOT_PASSWORD=<some password> usage comment in stacks/mysql.Dockerfile, which is a placeholder and is not modified by this PR.

Note: renovate/stability-days is still pending (minimum release age not met) — expected to clear on its own.

[claude]

Renovate bump review — no findings

Reviewed all 4 changed files against .claude/REVIEW.md. No blocking issues; nothing here adds stdout/stderr/log output, so the PII/secret criterion is not applicable.

Digest verification

Every pinned digest resolves to the claimed tag on Docker Hub:

Reference	Digest in PR	Verified
docker/dockerfile:1.26	ecfaec9e…	✅ matches 1.26 / 1.26.0
docker/dockerfile:1	ecfaec9e…	✅ 1 currently resolves to the same manifest (1.26.0 is the newest 1.x)
mysql:9.7.2	257388ed…	✅
node:24-alpine	d32cdf61…	✅ = 24.19.0-alpine3.24

All three # syntax= directives across the repo are now on the same digest — previously peerdb-server.Dockerfile was lagging on the 1.24 digest while the other two were on 1.25, so this bump also resolves that drift.

Regression analysis

docker/dockerfile 1.25 → 1.26 (moby/buildkit) — exactly one frontend release in the range (dockerfile/1.26.0, 2026-07-29). Its only notable change is #6930 "fix incorrect warning when matching dockerignore patterns to COPY ." — a lint/warning-only fix, no build-semantics change. Scanning the 183 commits in dockerfile/1.25.0...dockerfile/1.26.0, the only other frontend-touching change is a Windows SBOM-scanner temp-mount fix, which is irrelevant here (all builds are Linux). The --mount=type=cache usage in peerdb-ui.Dockerfile is unaffected. Low risk.

node:24-alpine digest a0b9bf0 → d32cdf6 — this is not a pure rebuild: it moves 24.18.0 → 24.19.0. The Alpine base is unchanged (both are alpine3.24), so the apk add --no-cache openssl layer is unaffected. The range picks up:

• v24.18.1 — security release, 11 CVEs (3 High: CVE-2026-56846/CVE-2026-56848 http2, CVE-2026-58043 permission model), plus llhttp 9.4.3 and undici 7.29.0.
• v24.19.0 — semver-minor additions only (blob.textStream(), --experimental-import-text, httpValidation, TLS certificate compression, ReadableStreamTee). No removals or behavior changes that affect a Next.js standalone build/runtime.

Net effect is a security improvement. Low risk, recommended.

mysql 9.7.1 → 9.7.2 (2026-07-28) — bug-fix-only patch release (release notes). Several fixes are actually favourable for a CDC product, e.g. replication no longer failing when deleting rows from a table with a self-referencing FK (Bug #39091367), SOURCE_RETRY_COUNT=0 now consistently treated as unlimited (Bug #39086875), and a race between concurrent local commits and applier work with log_replica_updates disabled (Bug #39259437). Two behaviour deltas worth noting for the record, neither of which affects this repo:

• thread_pool_max_unused_threads default changed 2 → 32 (thread pool plugin is not enabled in stacks/mysql/my.cnf.sample).
• group_replication_communication_stack / group_replication_ip_allowlist deprecated (Group Replication is not used).

Blast radius is small regardless: stacks/mysql.Dockerfile is a standalone local-dev helper image (bin_mysql) and is not referenced by any compose file or workflow — CI's MySQL matrix pins mysql:9.5 and mysql:5.7 in .github/workflows/flow.yml.

Note

docker-build (ubuntu-latest) is already green; renovate/stability-days is still pending on the minimum-release-age gate, which is expected and will clear on its own.

[claude]

Renovate bump review — clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing to flag inline.

Digests verified against the registry

All four pins resolve to the current tag digests on Docker Hub:

Pin	Digest verified
docker/dockerfile:1.26	ecfaec9…fc32 ✅
docker/dockerfile:1	ecfaec9…fc32 ✅ — same image; the 1 tag now floats to 1.26, so peerdb-server.Dockerfile effectively moves 1.25→1.26 as well
mysql:9.7.2	257388e…ab4e ✅
node:24-alpine	d32cdf6…ad43 ✅ (= 24.19.0-alpine3.24)

Upstream changes in the bumped ranges

docker/dockerfile 1.25.0 → 1.26.0 (release notes, 183 commits)

Outside of tests, only four files under frontend/dockerfile/ changed:

• dockerfile2llb/validations.go — dockerfile: fix CopyIgnoredFile for context root moby/buildkit#6930: the CopyIgnoredFile linter no longer emits a false-positive warning for COPY . . when .dockerignore has patterns like .*. Strictly fewer warnings; it is still emitted for genuinely root-excluding patterns (*, **, **/*). Safe even if a build ever runs with checks escalated to errors.
• builder/build.go — Windows SBOM scanner temp-mount fix; no effect on our Linux builds.
• builder/resolvecache.go — vendor swap mitchellh/hashstructure → gohugoio/hashstructure, affecting only an in-process dedup cache for image-config resolves, not persistent build cache keys.
• version/version.go — version string.

No new required gateway capabilities and no Dockerfile syntax or semantic changes. Every feature these Dockerfiles rely on (RUN --mount=type=cache, ADD --checksum, COPY --chown, multi-stage --from) is untouched. The rest of the range is BuildKit daemon-side work (solver cache-key fixes, exec security-mode validation, LLB input-index validation, fileop rm traversal containment, WCOW cache-mount pinning) plus CI/vendor churn — none of it reachable from the frontend image.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Bug-fix release, with nothing that regresses the settings in stacks/mysql/my.cnf.sample (log_bin, binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode=ON). What I checked:

• Replication changes are all fixes (self-referencing FK deletes under RBR, SOURCE_RETRY_COUNT=0 reconnect, heartbeat/rotate handling, generated TIMESTAMP NOT NULL on row-based apply) — none narrow behaviour for a binlog reader.
• Deprecations are group_replication_communication_stack and group_replication_ip_allowlist, neither used here.
• Only default-value change is thread_pool_max_unused_threads 2 → 32 (thread-pool plugin only).
• New reserved keywords CUBE, EXTERNAL, QUALIFY, TABLESAMPLE — grepped the MySQL connector and e2e SQL, no identifier collisions.
• Enterprise Linux 7 support dropped upstream, irrelevant to the container image.

Worth noting this Dockerfile is a manual dev helper — nothing in CI or compose references it, and flow.yml pins mysql:9.5 for the test matrix — so the blast radius is small either way.

node:24-alpine digest → 24.19.0 (release notes, 2026-08-03)

Semver-minor within Active LTS, rolling up the 24.18.1 security fixes (HTTP/2, HTTPS, permission model, SQLite, DNS, zlib). Ships npm 11.17.0, so npm ci in the dependencies stage is unaffected; the additions are opt-in APIs (blob.textStream(), --experimental-import-text, TLS certificateCompression). Nothing breaking for the Next.js standalone build.

Other checks

• No new stdout/stderr/log output, and nothing that could surface passwords, tokens, or PII. The MYSQL_ROOT_PASSWORD=<some password> string in mysql.Dockerfile is a pre-existing placeholder in a usage comment, not a credential.
• docker-build (ubuntu-latest) is green.

Minor and pre-existing, so out of scope here: peerdb-server.Dockerfile pins its syntax directive as docker/dockerfile:1 while flow/peerdb-ui pin docker/dockerfile:1.26. Renovate keeps them digest-identical, so it is purely cosmetic.

[github-actions]

🔄 Flaky Test Detected

Analysis: All tests in the pg17 job failed simultaneously with infrastructure errors ("Temporal client dial... context deadline exceeded" and "no mapping defined for search attribute MirrorName") because CI's readiness gate omits temporal/temporal-admin-tools and the one-shot search-attribute registration script races Temporal server startup — not a test or code defect.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

[claude]

Renovate dependency bump review — looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; no inline comments to leave.

Digest verification — every pinned digest resolves to the tag it claims:

Pin	Digest	Resolves to
docker/dockerfile:1.26 / :1	ecfaec9…	1.26.0 (also the current 1 alias) ✔
mysql:9.7.2	257388e…	9.7.2 / 9.7 / 9.7.2-oracle ✔
node:24-alpine	d32cdf6…	24-alpine3.24 → Node 24.19.0 on Alpine 3.24 ✔

Upstream review of the bumped ranges

docker/dockerfile 1.25 → 1.26 (1.26.0, released 2026-07-29) — 183 commits in the range, but only three non-test files under frontend/dockerfile/ actually changed:

• dockerfile2llb/validations.go — "fix CopyIgnoredFile for context root" (#6930), the sole notable change. It removes a false-positive lint warning for COPY . at the context root. None of the four Dockerfiles here copy from the context root (COPY flow ., COPY ui/ . are subdirectories), so no behavior change for us either way.
• builder/build.go — Windows SBOM scanner temp-mount fix; not applicable to these Linux builds.
• Docs for the WorkdirRelativePath lint rule; all WORKDIRs here are absolute.

The rest of the range is buildkit-daemon/vendor churn (containerd v2.2.5, golang.org/x/*, moby/sys/user v0.4.1) that the frontend image doesn't exercise differently for these builds. No new lint rules and no parser/syntax changes that would newly fail an existing Dockerfile. docker-build already passes on this PR, which corroborates that.

mysql 9.7.1 → 9.7.2 (LTS patch, 2026-07-27) — worth calling out because PeerDB does MySQL CDC, and this release is heavy on replication fixes, but they are all fixes in our favor, not regressions: ALTER USER binlog rewrite preserving empty auth data, row-based apply of generated TIMESTAMP NOT NULL columns with explicit_defaults_for_timestamp=OFF (now a warning + field default instead of a hard error), self-referencing FK deletes, SOURCE_RETRY_COUNT=0, heartbeat/rotate handling. Two behavior changes to be aware of, neither of which affects us: thread_pool_max_unused_threads default 2 → 32, and deprecation of group_replication_communication_stack / group_replication_ip_allowlist. Scope is limited anyway — stacks/mysql.Dockerfile is a manually-built local dev helper (per its own header comment); CI's MySQL matrix pins mysql:9.5 and friends separately and does not consume this image.

node:24-alpine digest (Node 24.18.0 → 24.19.0) — this one is a security improvement: the range crosses v24.18.1, a security release fixing 10 CVEs including two high-severity HTTP/2 issues (CVE-2026-56846, CVE-2026-56848) and a permission-system fix (CVE-2026-58043), plus llhttp 9.4.3 / undici 7.29.0. v24.19.0 is a non-security LTS minor whose changes are all additive (blob.textStream(), --experimental-import-text, httpValidation, TLS additions) — nothing removed or behavior-changed that the Next.js UI build depends on. The Alpine base stays 3.24 across both digests, so no musl/toolchain jump.

Secrets / PII (.claude/REVIEW.md rule 1) — nothing added that writes to stdout/stderr or logs. The MYSQL_ROOT_PASSWORD=<some password> string in stacks/mysql.Dockerfile is a pre-existing placeholder in a usage comment, unchanged by this PR.

One note for whoever merges: renovate/stability-days is still pending and automerge is enabled, so this will land on its own once the minimum release age is met.

[claude]

Renovate bump review — no findings ✅

Reviewed per .claude/REVIEW.md. Diff is 4 lines across 4 Dockerfiles, all image/frontend pin updates. No new stdout/stderr/log output, so nothing in the PII/secret-leakage category. Upstream release notes and commit logs checked for the bumped ranges:

docker/dockerfile 1.25 → 1.26 (stacks/flow.Dockerfile, stacks/peerdb-ui.Dockerfile, stacks/peerdb-server.Dockerfile)

dockerfile/1.26.0 (2026-07-29) has exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (moby/buildkit#6930).

Diffing dockerfile/1.25.0...dockerfile/1.26.0, the only non-test files touched under frontend/dockerfile/ are builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go, version/version.go, and the WorkdirRelativePath rule docs. The rest of the 183 commits are buildkit daemon/solver/executor/CI changes that the # syntax= frontend pin does not control. Two security-flavored commits in the range (security: validate exec security modes, user: limit size of parsed passwd/group files) live in executor/oci and solver/llbsolver/ops — daemon side, not the frontend, so unaffected by this pin.

Regression risk for this repo specifically:

• The dockerignore fix is warning-only; none of the three Dockerfiles use a bare COPY . at context root anyway (COPY flow ., COPY --chown=node:node ui/ .).
• WorkdirRelativePath was a docs-only change, and every WORKDIR in the three files is absolute.
• No docker build --check / BUILDKIT_STRICT lint gate in CI, so new/changed linter output can't fail a build.
• RUN --mount=type=cache (used in flow.Dockerfile and peerdb-ui.Dockerfile) is untouched in the range.

Note peerdb-server.Dockerfile tracks the floating 1 tag while the other two track 1.26 — all three now resolve to the same digest (ecfaec9…), so this bump actually converges them; previously 1 was at 87999aa… and 1.25 at 0adf442…, i.e. different frontends. Pre-existing config difference, not introduced here, just flagging that they can drift again when 1.27 lands.

mysql 9.7.1 → 9.7.2 (stacks/mysql.Dockerfile)

Patch release on the 9.7 LTS line (docker-library/mysql Update 9.7 to 9.7.2, oracle 9.7.2-1.el9). Release notes contain no CVEs and several replication/binlog fixes rather than regressions (SOURCE_RETRY_COUNT=0 reconnect handling, TIMESTAMP NOT NULL row-based apply, self-referencing FK deletes, ALTER USER binlog rewrite). Behavior changes are EL7 support removal, group_replication_* deprecations, and thread_pool_max_unused_threads default 2 → 32 — none reachable from this image's usage.

Low blast radius regardless: stacks/mysql.Dockerfile is a manual dev helper (its own header documents docker build/docker run) and is not referenced by CI; flow.yml uses stock mysql:9.5 for the e2e matrix.

node:24-alpine digest a0b9bf0 → d32cdf6 (stacks/peerdb-ui.Dockerfile)

Resolves to Node 24.19.0 on Alpine 3.24. The previously pinned digest dated to the last bump (#4514, 2026-06-29), when 24-alpine was Node 24.18.0 — also already alpine3.24, so no base-OS change, just Node 24.18.0 → 24.19.0.

This is a net positive: it picks up v24.18.1, a security release fixing 11 CVEs (three High: CVE-2026-56846, CVE-2026-56848, CVE-2026-58043) plus llhttp 9.4.3 / undici 7.29.0. v24.19.0 is all SEMVER-MINOR additions — no removals or breaking changes that would affect the Next.js build or npm ci. Alpine staying at 3.24 means apk add --no-cache openssl and the uid/gid 1000 node user assumptions in the cache mount are unchanged.

Digest verification

All four pins verified against the live registry — each digest is the current one for its tag, and no tag/digest mismatch:

Ref	Pinned digest	Registry
docker/dockerfile:1.26	ecfaec9…	✅ match
docker/dockerfile:1	ecfaec9…	✅ match
mysql:9.7.2	257388e…	✅ match
node:24-alpine	d32cdf6…	✅ match

Status

renovate/stability-days is currently pending (minimum release age not met), so automerge is held until that clears — expected, no action needed.

No regressions identified. LGTM.

[claude]

Renovate dependency review — no findings

Reviewed per .claude/REVIEW.md. No secrets/PII exposure in the diff, and no regression risk identified in the bumped ranges.

Digest verification — all four pins resolve to the current Docker Hub tags:

Reference	Digest in PR	Resolves to
docker/dockerfile:1.26 / docker/dockerfile:1	ecfaec9…	✅ both tags point at the same index digest (consistent across the three Dockerfiles)
mysql:9.7.2	257388e…	✅ pushed 2026-07-28
node:24-alpine	d32cdf6…	✅ 24.19.0-alpine3.24, pushed 2026-08-03

docker/dockerfile 1.25 → 1.26 (1.26.0, 2026-07-29)

Only one user-visible frontend change since 1.25.0: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930) — removes a spurious lint warning, no syntax or semantic changes. The rest of the range is BuildKit-side work, notably the security hardening backported from v0.31.1 (validate exec security modes, cap parsed passwd/group size, reject special files for ref reads). No new minimum BuildKit requirement for anything these Dockerfiles use, and docker-build passes on this PR, confirming the frontend works with the BuildKit in CI.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

Bugfix-only release, no CVEs listed. Behavior changes worth knowing, none of which affect this repo:

• thread_pool_max_unused_threads default 2 → 32 (Enterprise thread pool).
• CUBE, EXTERNAL, QUALIFY, TABLESAMPLE are now properly reserved words — grepped the tree, the only QUALIFY use is Snowflake SQL (flow/connectors/snowflake/qrep_avro_consolidate.go), not MySQL.
• Enterprise Linux 7 support dropped (irrelevant to the official image used here).

Several replication/binlog fixes land in this release (row-based apply with explicit_defaults_for_timestamp=OFF, SOURCE_RETRY_COUNT=0 handling, writable-replica commit race) — all fixes, nothing CDC-visible removed. Note that stacks/mysql.Dockerfile is a local dev helper; e2e CI pins mysql:9.5 / mysql:5.7 via the flow.yml matrix, so this bump is not exercised by the test suite.

node 24-alpine digest

Patch-level rebuild within Node 24 on Alpine 3.24 (same Alpine minor as the previous pin), consumed only by the UI build stages. No lockfile or engine constraint changes needed.