From b679e0f722e91765e4eb06bbd044a6b7f4fa0c15 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:18:14 +0000
Subject: [PATCH 1/4] chore: update golang:1.27.2-alpine docker digest to
 f92b6ef

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c5e539f71..c27c505e4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -453,7 +453,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # a silent upstream base rebuild is caught by toolchain-key.sh. The pinned digest
 # is refreshed by the daily toolchain rebuild's `--pull` + Renovate.
 # renovate: datasource=docker depName=golang
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS caddy-inline
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS caddy-inline
 ARG TARGETOS
 ARG TARGETARCH
 ARG CADDY_VERSION
@@ -813,7 +813,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # recipe. Compiled by toolchain-image.yml and the fork/offline fallback only; the
 # default app build COPY --from's its output out of the pinned toolchain image.
 # renovate: datasource=docker depName=golang
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS crowdsec-inline
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS crowdsec-inline
 COPY --from=xx / /
 
 WORKDIR /tmp/crowdsec

From a0d26d393bb92da974d26ea89f74a62d2439d1f8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:29:39 +0000
Subject: [PATCH 2/4] chore(docker): sync toolchain image pin to
 caddy-crowdsec-e5c64e05921f04ff

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c27c505e4..dcf96c4ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-2bacd2d63ba9664d
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:049dedfb96e765c0c29261f5b74e96d90b967c16ae64888e029537973d790e01
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-e5c64e05921f04ff
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:f3346219f934697282f0cde3a2a1619dc22ca1ed43553d26d6189500128edebe
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass

From 36eed4ba1acc5b6aba0e13fde699ebf1d0aaa610 Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Sat, 10 Oct 2026 10:46:32 -0400
Subject: [PATCH 3/4] chore: update golang:1.27.2-alpine to specific digest
 f92b6ef for backend builder

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index dcf96c4ab..9c7ee4670 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -317,7 +317,7 @@ RUN --mount=type=cache,target=/app/frontend/node_modules/.cache \
     npm run build
 
 # ---- Backend Builder ----
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS backend-builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS backend-builder
 # Copy xx helpers for cross-compilation
 COPY --from=xx / /
 

From 55ee9d5809c0f995d0346c7dbde4557c9a66b9e2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:01:15 +0000
Subject: [PATCH 4/4] chore(docker): sync toolchain image pin to
 caddy-crowdsec-5e0625fbc54f3423

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9c7ee4670..6c197dae4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-e5c64e05921f04ff
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:f3346219f934697282f0cde3a2a1619dc22ca1ed43553d26d6189500128edebe
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-5e0625fbc54f3423
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:cdfab62cc075c0cf40a0f313968d66b8506400bf6382c021264e31ef32291fdf
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass