Update dockerfile dependencies - #4682

Reviewed this Renovate bump — no findings, looks clean.

Digest verification

Both pins resolve to the current published manifest for their tag:

• docker/dockerfile:1.26 → sha256:ecfaec9e…95fc32 ✅ (Hub manifest digest, pushed 2026-07-29)
• mysql:9.7.2 → sha256:257388ed…a7ab4e ✅ (Hub manifest digest, pushed 2026-07-28)

docker/dockerfile 1.25 → 1.26 (moby/buildkit, dockerfile/1.25.0…dockerfile/1.26.0, 183 commits)

Release notes list a single notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). Filtering the 300 changed files down to non-test frontend code, only three matter — builder/build.go, builder/resolvecache.go, dockerfile2llb/validations.go — and the only change to validations.go in this range is that same CopyIgnoredFile context-root fix (3c2df0f5). Everything else is vendoring, CI, and buildkit daemon/exporter-side work (e.g. exporter: default attestations to OCI artifacts, plus the platform-ID sanitization that was reverted again in 56cf3cc0), which the frontend pin does not pull in.

Hardening commits backported from v0.31.1 (security: validate exec security modes, user: limit size of parsed passwd/group files, fs: reject special files for ref reads) do not affect these Dockerfiles: neither uses RUN --security=…, and the --mount=type=cache,uid/gid and COPY --chown user lookups only touch the tiny /etc/passwd in the alpine/node base images.

The CopyIgnoredFile change is a lint-warning fix, not build semantics, and nothing in CI or the Tiltfile enables --check / BUILDKIT_DOCKERFILE_CHECK=error, so it cannot turn into a build failure here. docker-build is already green on this PR.

mysql 9.7.1 → 9.7.2 (release notes, 2026-07-28)

No incompatible changes. Relevant to PeerDB's MySQL CDC path, the replication/binlog fixes are net-positive rather than regressions — e.g. row-based apply with stored TIMESTAMP NOT NULL columns (Bug #120128/#39182574), replication of deletes on self-referencing FK rows (#119996/#39091367), a race on writable replicas with log_replica_updates disabled (#39259437), and SOURCE_RETRY_COUNT=0 now consistently meaning unlimited reconnects (#39086875).

Checked the potentially disruptive items against this repo; none apply:

• Deprecated group_replication_communication_stack / group_replication_ip_allowlist — not referenced in stacks/mysql/my.cnf.sample; the settings it does use (log_bin, binlog_format=ROW, binlog_row_image=full, binlog_row_metadata=full, gtid_mode, enforce_gtid_consistency) are untouched by 9.7.2.
• thread_pool_max_unused_threads default 2 → 32 — thread pool is an Enterprise plugin, not active in the community image.
• Enterprise Linux 7 / glibc 2.17 support dropped — does not affect the official Docker image.

Blast radius is also limited: stacks/mysql.Dockerfile is a local/manual dev image (its own header documents the docker build / docker run usage) and is not referenced by the Tiltfile or CI. The flow_test matrix pins mysql:9.5 and mysql:5.7 independently (.github/workflows/flow.yml:57-58).

_{Unrelated to this PR, just flagging: stacks/peerdb-server.Dockerfile pins the floating docker/dockerfile:1 tag rather than a minor tag, so it stays on a different frontend digest than the two files bumped here. Renovate tracks it separately.}

Review: dependency bump reviewed — looks clean ✅

No findings. Reviewed per .claude/REVIEW.md: no PII/secret output added, and upstream release notes plus commit logs were read for the full bumped range.

Digest/tag integrity — all three pinned digests match what the tags currently resolve to on the registry:

docker/dockerfile 1.25.0 → 1.26.0 (release, 2026-07-29) — exactly one notable change: buildkit#6930 "dockerfile: fix CopyIgnoredFile for context root", which stops COPY . . from being falsely reported as copying an ignored file when .dockerignore excludes dotfiles via .*. Warning-only, with no change to actual copy semantics — and our .dockerignore has no .* / * catch-all pattern regardless. There is no --check lint gating in the build workflows, so changed lint output cannot fail CI. The frontend features in use here (ADD --checksum=, RUN --mount=type=cache) are long-stable. No regression risk.

mysql 9.7.1 → 9.7.2 (relnotes, docker-library commit) — patch release, bug fixes only. The replication/binlog changes are all fixes (SOURCE_RETRY_COUNT=0 reconnect race, heartbeat and log-rotate event handling, row-based apply of generated TIMESTAMP NOT NULL, self-referencing FK deletes); nothing alters binlog wire format, binlog_row_metadata=full, or the GTID semantics that PeerDB MySQL CDC depends on. The two deprecations (group_replication_communication_stack, group_replication_ip_allowlist) and the thread_pool_max_unused_threads default change (2 → 32) do not touch stacks/mysql/my.cnf.sample, so mysqld startup is unaffected. Dropped EL7 support is irrelevant to the container image. This image is dev/test-only (bin_mysql), so blast radius is limited regardless.

node:24-alpine digest — resolves 24.18.0-alpine3.24 → 24.19.0-alpine3.24. Same Alpine base: the previous pin landed 2026-06-29, after Alpine 3.24 became the docker-node default (docker-node#2534, 2026-06-10), so this is a rebuild plus a Node minor, not a hidden Alpine major bump. The range picks up v24.18.1 (2026-07-29), a security release with 11 CVE fixes (HTTP/2 header memory retention, permission-model gaps, DNS large replies, TLS session binding/SNI, SQLite iterator invalidation, zlib overflow) — a net positive. The v24.19.0 additions are purely additive (blob.textStream(), TurboSHAKE/KangarooTwelve, --experimental-import-text, httpValidation, TCP keepalive knobs), with no deprecations or behavior changes affecting the Next.js build or runtime.

_{Non-blocking, pre-existing, and out of scope for this PR: .github/workflows/flow.yml:57 still pins the mysql-gtid matrix entry to a floating mysql:9.5, which now diverges two minors from the dev image.}

Reviewed this Renovate bump per .claude/REVIEW.md — no findings.

Digest verification

All three pins resolve to the tags they claim, checked against Docker Hub right now:

Upstream changes in the bumped range

docker/dockerfile 1.25 → 1.26 (moby/buildkit dockerfile/1.26.0, 2026-07-29)

The release notes list exactly one notable change: "Fix incorrect warning when matching dockerignore patterns to COPY ." (#6930). The rest of the frontend-relevant commits in 1.25.0...1.26.0 are hardening / bug fixes — fileop: contain rm parent traversal, fs: reject special files for ref reads, security: validate exec security modes, dockerfile: fix Windows SBOM scanner temp mount. No Dockerfile syntax or semantic changes, and neither flow.Dockerfile nor peerdb-ui.Dockerfile uses anything affected — the --mount=type=cache usage in both is unchanged in behavior.

Note that stacks/peerdb-server.Dockerfile still pins docker/dockerfile:1@sha256:87999aa3… and was not touched. That is correct rather than a miss: the floating 1 tag upstream is itself still at 87999aa3 (last pushed 2026-05-20).

mysql 9.7.1 → 9.7.2 (release notes, LTS patch)

Nothing that looks like a regression risk for PeerDB. Several fixes land in our favour on the MySQL CDC path:

• SOURCE_RETRY_COUNT=0 now consistently means unlimited reconnects (Bug #39086875)
• Row-based apply no longer fails with Cannot be null on generated TIMESTAMP NOT NULL columns when explicit_defaults_for_timestamp is off (Bug #120128)
• Replication fixes for self-referencing FK deletes, heartbeat handling, binlog rotate events, and binlog transaction compression stats concurrency

The two incompatible changes in the release (EL7 support dropped, thread_pool_max_unused_threads default 2 → 32) do not affect this image. stacks/mysql.Dockerfile is the local dev/test image only; the CI matrix (mysql:9.5) and flow/e2e/test_data/mysql-debug/Dockerfile (8.0.46) are pinned separately and intentionally unchanged.

node:24-alpine digest bump — worth calling out, since Renovate labels it a "digest" update: it is not a rebuild, it is Node 24.18.1 → 24.19.0 (docker-node fd1bf45, v24.19.0, released 2026-08-03), i.e. a semver-minor within the 24 line. The Alpine base is unchanged (alpine:3.23; 3.22 was dropped back in June, well before the previous pin). Changes are additive API surface (blob.textStream(), --experimental-import-text, TCP_KEEPINTVL/TCP_KEEPCNT in setKeepAlive, certificateCompression) plus stricter crypto input validation (rejecting small-order EdDSA points, invalid raw key imports, large DH generator validation) — none of which the Next.js UI build or runtime exercises. No 24.19.1 has been cut in the nine days since release, and the arch-case removals in the upstream Dockerfile only drop x86/armv7/ppc64le, not the x86_64/aarch64 platforms we build.

Other checks

• No new stdout/stderr/log output, and nothing that could surface credentials or PII — the diff is four pinned-image lines. The pre-existing MYSQL_ROOT_PASSWORD placeholder in the mysql.Dockerfile header comment is untouched.
• docker-build is green on this PR; flow_test was still running at review time.

🔄 Flaky Test Detected

Analysis: TestApiMy/TestTableAdditionWithoutInitialLoad hit the fixed 60s polling deadline in SetupCDCFlowStatusQuery while the mirror was still in STATUS_SETUP — a wall-clock timeout under CI load on a Renovate Dockerfile bump, with the same suite passing on the other two matrix legs.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run

🔄 Flaky Test Detected

Analysis: A whole-stack stall on the single maria-12 matrix leg made every MariaDB→ClickHouse test time out (mirrors stuck in STATUS_SETUP, CDC never delivered) until Go's 20m package timeout panicked and marked all 95 in-flight/waiting tests failed, while the other two matrix legs ran the same suites successfully against unchanged service images on a Renovate Dockerfile-bump PR.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run