From 6dc6c0235caba4cd67188508759665351e84f754 Mon Sep 17 00:00:00 2001
From: craigthackerx <34176957+craigthackerx@users.noreply.github.com>
Date: Wed, 11 Nov 2026 08:31:37 +0000
Subject: [PATCH] chore: refresh base image digests and security patches

---
 versions.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/versions.yml b/versions.yml
index 09ab11b..5f3a998 100644
--- a/versions.yml
+++ b/versions.yml
@@ -50,21 +50,21 @@ platforms:
 # change to this block alone. Keep each value a bare reference: `just pin`
 # rewrites it.
 bases:
-  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:52a1dd05ab0348e71cf244d595d9ce59268c68ac3fdd6338c18997fe035b36a7
-  debian: dhi.io/debian-base:trixie-debian13-dev@sha256:61025cea33d5910165ced8b33edd3f6b6bfe161e129174887936a1b9a1442b20
-  python-3.12: dhi.io/python:3.12-debian13-dev@sha256:a211f0321f6b95709f447f5bf9a88c7d92ee42c71f40ad07741e3865ae6d23bc
-  python-3.13: dhi.io/python:3.13-debian13-dev@sha256:1303a6c6e9b856cfe9e1b25eaf44b4a165c28a8402140ef3b5151d9a60e4033a
-  python-3.14: dhi.io/python:3.14-debian13-dev@sha256:9ac7d2837dbd5739f0657be0b4af1cf9c6d0cc582a5d5886da9d4b321a03b8c3
-  python-3.15: dhi.io/python:3.15-debian13-dev@sha256:f9121e954baf4ec5f29d85f5025b64b4274054607db9753ac090a42281c66a7d
+  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:266554e75cb00f88effe4048ba78b6f628d6a5ca67ac9e9727ae37a4a1299ce5
+  debian: dhi.io/debian-base:trixie-debian13-dev@sha256:94571f3dc07fbc7166f6f1cbf1fe068a7647198ee2554e6b90d59a68cc8b053c
+  python-3.12: dhi.io/python:3.12-debian13-dev@sha256:0d6504c73ca949daf82382a10fa34275f2f3a1acea58aa29411296d27601fa83
+  python-3.13: dhi.io/python:3.13-debian13-dev@sha256:c7d432e13c0515c555cbb37c30aca57b9bd192775bb0e3101c4f5fac73fc868a
+  python-3.14: dhi.io/python:3.14-debian13-dev@sha256:a38c43b0212baf7a5b6b0e2010a45e0c25e6cc37af044c1b8a6fdfd2c5b22ba1
+  python-3.15: dhi.io/python:3.15-debian13-dev@sha256:bd03dfeeb9fd00ba49e01701fa9014af705c33b1999715ebe3048b8e47c08186
 
 # Other bases that every pull request builds and smoke tests the latest
 # version of each image on, so that changing distribution stays a one-line
 # edit. Nothing built on these is published.
 portability:
-  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:52a1dd05ab0348e71cf244d595d9ce59268c68ac3fdd6338c18997fe035b36a7
+  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:266554e75cb00f88effe4048ba78b6f628d6a5ca67ac9e9727ae37a4a1299ce5
   rhel: registry.access.redhat.com/ubi10/ubi:10.1@sha256:15f0a6e2b448ac7aa24425c9ab541e6402dc32b782844a285ccaeffb1c938fe1
-  rhel-minimal: registry.access.redhat.com/ubi10/ubi-minimal:10.2@sha256:c3fe95ec9f53a3888c47314eb4d08bde09ebde646a428137b445091afe1daf89
-  wolfi: cgr.dev/chainguard/wolfi-base:latest@sha256:24f549a7fcace88e69b9557941168c74645688ecc4acf7fb6d734a6b74e9019d
+  rhel-minimal: registry.access.redhat.com/ubi10/ubi-minimal:10.2@sha256:f0c7b9ae9914fcf183e7c36fc46864903c2d2caf3af327421913ae54b3d29e94
+  wolfi: cgr.dev/chainguard/wolfi-base:latest@sha256:94fa13e26d449f7d78dbcd02d12ea37a0da80d24fcc3e1f17b95d515dec607a7
 
 # Tools, by exact version. The Go tools (shfmt, tenv, TFLint, terraform-docs,
 # Conftest) are built from source with this Go, never downloaded as binaries,