fix(misc): bump the docker-minor group in /apps/cli-go/pkg/config/templates with 5 updates - #6502
Closed
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 5 updates: | Package | From | To | | --- | --- | --- | | supabase/studio | `2026.08.24-sha-8ec45b2` | `2026.09.07-sha-7996410` | | supabase/edge-runtime | `v1.74.3` | `v1.76.2` | | supabase/realtime | `v2.130.0` | `v2.134.10` | | supabase/storage-api | `v1.72.1` | `v1.74.0` | | supabase/logflare | `1.50.6` | `1.50.11` | Updates `supabase/studio` from 2026.08.24-sha-8ec45b2 to 2026.09.07-sha-7996410 Updates `supabase/edge-runtime` from v1.74.3 to v1.76.2 Updates `supabase/realtime` from v2.130.0 to v2.134.10 Updates `supabase/storage-api` from v1.72.1 to v1.74.0 Updates `supabase/logflare` from 1.50.6 to 1.50.11 --- updated-dependencies: - dependency-name: supabase/studio dependency-version: 2026.09.07-sha-7996410 dependency-type: direct:production dependency-group: docker-minor - dependency-name: supabase/edge-runtime dependency-version: v1.76.2 dependency-type: direct:production dependency-group: docker-minor - dependency-name: supabase/realtime dependency-version: v2.134.10 dependency-type: direct:production dependency-group: docker-minor - dependency-name: supabase/storage-api dependency-version: v1.74.0 dependency-type: direct:production dependency-group: docker-minor - dependency-name: supabase/logflare dependency-version: 1.50.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![supabase-cli-releaser[bot]](https://avatars.githubusercontent.com/u/54469796?s=60&v=4){kind=small}
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@6ab90dbf5c582137809e1e1a92faf5f3452cc563Preview package for commit |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
Member
|
Closing as superseded by #6521, which fixed the automation that made this red. This PR failed on This PR is also conflicted against Generated by Claude Code |
pull Bot
pushed a commit
to oogalieboogalie/cli
that referenced
this pull request
Sep 8, 2026
…he slim-services feed (supabase#6521) ## Summary Dependabot's docker updates on `apps/cli-go/pkg/config/templates/Dockerfile` have been landing red — see supabase#6502 (realtime) and supabase#6503 (postgres). Two independent causes, plus the automation the second one leaves behind. **1. A unit test asserted the exact current pins while reading them from the live manifest.** `slim-images.unit.test.ts` had a `maps current docker.io pins onto the published slim tags` case that fed `dockerfileServiceImageRaw(alias)` in and asserted a spelled-out version for `pg`, `supavisor`, `realtime`, and `storage`. Any bump of those four failed the unit suite by construction. The assertions that must track the manifest — which slim repository each alias maps to — already live in the `it.each` above and slice the tag off before comparing, so they stay. Live-tag validation also survives more strongly elsewhere: `start.slim-images.e2e.test.ts` translates the current manifest pins and actually pulls them, so an unpublished translated tag fails CI on the registry rather than on a hand-typed string. The version-bearing block only encoded the per-service tag-prefix scheme, so it is replaced with fixed pins covering the same scheme, plus the uppercase-`V` normalization arm in `slimTagForService` that had no coverage. **2. `sync-stack-service-versions.yml` targeted files that no longer exist.** It ran `pnpm sync:versions` in `packages/stack` and committed `packages/stack/src/ServiceCatalog.ts`. supabase#6440 deleted both the script and that file, so the workflow would have hard-failed on the next dependabot Dockerfile PR. It survived supabase#6502/supabase#6503 only because those were opened about two hours before supabase#6440 merged. **3. The stack's pins now ride the feed that can actually maintain them.** Deleting that workflow leaves `WorkloadCatalog.ts` — `ServiceCatalog.ts`'s replacement — with no automation, so this adds it. The catalog pins each workload to an exact slim-services artifact release: a version **plus its `ghcr.io/supabase/cli` image digest**, per ADR 0017, which makes the artifact release the boundary for service startup defaults. Dependabot owns the Dockerfile and structurally cannot own this table — it resolves registry tags and never produces a `sha256:` digest, which is why repointing the old workflow was not an option. slim-services already sends this repo a `mirror-slim-image` `repository_dispatch` per release carrying `service`/`version`/`digest`, to drive the ECR mirror. `sync-stack-workload-catalog.yml` subscribes to that same dispatch and opens a PR pinning the release. It is deliberately a separate workflow from `mirror-slim-image.yml`: that mirror runs against the sender's 15-minute verification poll, and a catalog PR must never delay it or turn its run red. ## Reviewer notes Only two source values change per release. `artifactFor` derives `releaseTag`, `assetName`, and every download URL from `service` + `version`, and `releases` is derived from `defaultVersion` plus the container image, so rewriting the `native(...)` positional version and image is the whole change. **postgres is the one service carrying two supported release lines** (17.x and 15.x via `additionalReleases`), so the plan picks its target by release line — a 15.x release moves the additional entry and can never overwrite the 17.x default. That is the main correctness risk here and it has a dedicated test. A release on a line the catalog does not carry, a service it does not model, and a re-dispatch of an already-pinned release are all successful no-ops, so the sender's retry path does not open duplicate PRs. The dispatch payload arrives with whatever authority holds the dispatch token, so `sync-workload-catalog.ts` revalidates `service`/`version`/`digest` against the same patterns `mirror-slim-image.yml` uses rather than trusting the workflow. Those patterns are what stop a version or digest breaking out of the TypeScript string literals it writes into. `planCatalogUpdate` is pure and covered by 21 `bun:test` cases in `.github/scripts/`, which `github-scripts-ci.yml` already tests and type-checks. One of them sweeps every service the real catalog models, so a newly modelled workload is covered without editing a fixture list. `WorkloadCatalog.ts` also gains a provenance comment: it and the Dockerfile list overlapping service versions and are meant to diverge, so the next reader needs to know not to "reconcile" them. ## Linked issue No Linear ticket — repository maintenance prompted by the two failing dependabot PRs above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PWXmTVTiQCwuyjZ8Mfw9NL --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 5 updates:
2026.08.24-sha-8ec45b22026.09.07-sha-7996410v1.74.3v1.76.2v2.130.0v2.134.10v1.72.1v1.74.01.50.61.50.11Updates
supabase/studiofrom 2026.08.24-sha-8ec45b2 to 2026.09.07-sha-7996410Updates
supabase/edge-runtimefrom v1.74.3 to v1.76.2Updates
supabase/realtimefrom v2.130.0 to v2.134.10Updates
supabase/storage-apifrom v1.72.1 to v1.74.0Updates
supabase/logflarefrom 1.50.6 to 1.50.11Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions