[dependabot]

Bumps the docker-compose-patch-and-minor group in /docker with 1 update: postgres.

Updates postgres from 16-alpine to 16-alpine

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[patrickbrandao]

Review of #47: chore(deps): bump postgres 16-alpine digest in /docker

Reviewed commit afc54c7e895ac521935bdea47e2274b564b76862 (one Dependabot commit on top of 5e2530e) with git diff origin/main...afc54c7. origin/main is now 8b5fce2, three commits ahead of the PR base (#55, #56, #65). None of them touch docker/.

Summary

The diff is a single line, docker/docker-compose.yml:213, and changes only the digest. The tag stays postgres:16-alpine, so the major stays 16. The new digest is exactly what postgres:16-alpine resolves to today, it is the official Docker Library image, and its multi-arch index covers amd64 and arm64. There are no blockers and no high-risk criterion applies. There is one should-fix: a second pin of the same image, in the Apple Containers deploy script, is left on the old digest.

Digest verification (docker buildx imagetools inspect, manifests only)

	Old sha256:20edbde7…9416	New sha256:721873c3…80ea
postgres:16-alpine resolves to	no	yes (same index digest)
PostgreSQL / Alpine	16.13 / alpine3.23	16.15 / alpine3.24
Created	2026-02-26	2026-09-17
Source	docker-library/postgres@31041e4 16/alpine3.23	docker-library/postgres@9d15534 16/alpine3.24
linux/amd64	60b18062…	1a66d744…
linux/arm64/v8	d4e7bbd5…	2c942175…

Both indexes also carry 386, arm/v6, arm/v7, ppc64le, riscv64 and s390x, plus attestation manifests. Every platform in the new index is annotated 16.15-alpine3.24.

What changes at runtime:

• PostgreSQL 16.13 to 16.15 is a minor bump within major 16. The on-disk format is the same, so an existing pgdata volume starts without dump/restore or pg_upgrade.
• Alpine 3.23 to 3.24 changes the musl/ICU userland. The databases use the default libc provider (initdb in PG16 does not default to ICU), so there should be no collation-version problem. Even so, qa-docker should confirm that an existing volume opens without collation version mismatch warnings.

CI

gh pr checks 47 is all green: Lint, Unit (backend/cli/frontend/shared), Backend e2e (PostgreSQL 16), Compose smoke test (read-only), install.sh end-to-end, CodeQL and dependency-review. The Compose smoke job uses docker/docker-compose.yml, so the new Postgres digest really booted, on amd64 only.

The runs date from 2026-10-10 18:06 UTC, against merge base 5e2530e. Main has moved three commits since then. None touch the compose file, and git merge-tree against current main is clean. Before merge, comment @dependabot rebase so the gate is green on a current base. Do not push to the branch yourself, because a manual push stops Dependabot from maintaining it.

Runtime and qa-docker

This changes the database image of the default deployment, so qa-docker is required before merge (ADR 0002). Suggested scope:

1. Do a fresh docker compose up on the Mac host. That runs natively on arm64, which CI does not cover.
2. Run an in-place upgrade:
   • Start the stack on main (old digest, 16.13), create an admin, an agent, a provider and one proxied request.
   • Switch to this head and run docker compose up -d.
   • Confirm the data is still there, SELECT version() reports 16.15, and the Postgres log has no collation warnings.
3. Run the usual smoke/e2e.

Findings

Blockers: none.

S1 (should-fix): the Apple Containers deploy still pins the old Postgres digest

• Where: deploy/apple-containers/start.sh:85, which has POSTGRES_IMAGE="postgres:16-alpine@sha256:20edbde7749f822887a1a022ad526fde0a47d6b2be9a8364433605cf65099416".
• Dependabot does not track shell scripts, so this pin stays on 16.13 / alpine3.23 after this PR merges.
• Failure scenario: Apple Containers users keep running a Postgres two patch releases older than Compose users, including any security fixes in 16.14 and 16.15. The two supported deployments also drift silently on every later bump.
• Fix: don't edit this Dependabot branch. Update the line in a follow-up PR, ideally with a CI check that fails when the digest in start.sh differs from the one in docker/docker-compose.yml. Alternatively, track it in Templates de deploy da comunidade #30 (community deploy templates) or Docker, Compose e instalador do Thinker #26 (Docker, Compose and installer).

N1 (nit): squash subject. The PR title says "Bump postgres from 16-alpine to 16-alpine", which tells a reader of git log nothing. When merging, pass something like --subject "chore(deps): bump postgres 16-alpine digest (16.13 -> 16.15)" to gh pr merge.

N2 (nit): release notes. Compose users get a database patch upgrade. There is no selectable changeset target other than the legacy package, so record the line for the v0.1 notes in #31.

Project and security checks

• No new outbound destination. The image comes from the same Docker Hub official repository as before.
• No new manifest/mnfst identifiers. The existing POSTGRES_USER=manifest context is legacy and covered by Docker, Compose e instalador do Thinker #26.
• No auth, crypto, migration, workflow, Dependabot-config or governance change. Merging does not publish anything, since ci: add provisional minimal CI and remove inherited publish workflows #44 removed the publish workflows.

Interaction with the open stack (#51, #52, #57, #60, #66, #70)

• I simulated each merge with git merge-tree --write-tree. chore(deps): Bump postgres from 16-alpine to 16-alpine in /docker in the docker-compose-patch-and-minor group #47 merges cleanly into current main, together with chore(deps): Bump the docker-patch-and-minor group in /docker with 2 updates #48, and against the refactor(frontend): remove the SaaS layer from the dashboard #51 and feat(backend)!: remove phone-home from the backend and the CLI #70 heads.

• Only feat(backend)!: remove phone-home from the backend and the CLI #70 touches docker/docker-compose.yml (hunk at lines 148-160) and deploy/apple-containers/start.sh (around line 316). Neither overlaps line 213 or line 85.

• Suggested order:

  1. @dependabot rebase.
  2. Get qa-docker green.
  3. Merge chore(deps): Bump postgres from 16-alpine to 16-alpine in /docker in the docker-compose-patch-and-minor group #47 and chore(deps): Bump the docker-patch-and-minor group in /docker with 2 updates #48 (either order; they touch disjoint files) before the cleanup stack lands.
  4. Rebase the stack onto the new main.

  Landing the digests first means the stack's own qa-docker runs validate the images that will ship.

Merge note

Under aprovado, S1 must be fixed or tracked in an issue, and that issue's link must be recorded in this PR before merge. The other merge gates still apply: CI green on a current base after the rebase, and qa-docker, because this changes runtime behavior.

Head revisado: afc54c7
Veredito: aprovado

[patrickbrandao]

Destino dos should-fixes: S1 do #47 na #30; S1 do #48 na #26; as notas de release na #31.