ci: bump the all-docker-dependencies group across 8 directories with 5 updates

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the all-docker-dependencies group with 4 updates in the /.pipelines/build/dockerfiles directory: azurelinux/distroless/base, azurelinux/base/core, oss/v2/fluent/fluent-bit and windows/servercore.
Bumps the all-docker-dependencies group with 2 updates in the /azure-ip-masq-merger directory: azurelinux/distroless/base and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 3 updates in the /azure-ipam directory: azurelinux/distroless/base, azurelinux/base/core and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 3 updates in the /azure-iptables-monitor directory: azurelinux/distroless/base, azurelinux/base/core and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /bpf-prog/ipv6-hp-bpf directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 2 updates in the /cilium-log-collector directory: oss/v2/fluent/fluent-bit and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 3 updates in the /cni directory: azurelinux/distroless/base, azurelinux/base/core and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 3 updates in the /cns directory: azurelinux/distroless/base, azurelinux/base/core and oss/go/microsoft/golang.

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates azurelinux/base/core from daa1142 to 34a22db

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates windows/servercore from 3a2a2fd to 76cf422

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates oss/go/microsoft/golang from 829285f to 3c78e98

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates azurelinux/base/core from daa1142 to 34a22db

Updates oss/go/microsoft/golang from 829285f to 3c78e98

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates azurelinux/base/core from daa1142 to 34a22db

Updates oss/go/microsoft/golang from 829285f to 3c78e98

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates oss/go/microsoft/golang from 829285f to 3c78e98

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates azurelinux/base/core from daa1142 to 34a22db

Updates oss/go/microsoft/golang from 829285f to 3c78e98

Updates azurelinux/distroless/base from 387a603 to 4377af4

Updates azurelinux/base/core from daa1142 to 34a22db

Updates oss/go/microsoft/golang from 829285f to 3c78e98

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Unresolved moderate findings require template synchronization and consistent Go image references.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Dependabot refreshes pinned Docker base images, Fluent Bit, Windows Server Core, and Microsoft Go images across component and pipeline Dockerfiles.

Changes:

• Updates Azure Linux image digests.
• Bumps Microsoft Go and Fluent Bit images.
• Refreshes the Windows Server Core image.

Review findings:

• Moderate (3 votes): The pipeline Cilium log collector template still references Fluent Bit v4.2.3-16.
• Moderate (1 vote): NPM Linux and Windows builders remain on Go 1.26.7.
• Nit (3 votes): The BPF helper comment still references Go 1.26.7.
• Moderate (3 votes): The Cilium log collector template still references Fluent Bit v4.2.3-16.

File summaries

File	Description
cns/Dockerfile	Updates Go and Azure Linux pins.
cni/Dockerfile	Updates Go and Azure Linux pins.
cilium-log-collector/Dockerfile	Updates Go and Fluent Bit pins.
bpf-prog/ipv6-hp-bpf/linux.Dockerfile	Updates the Go builder image.
azure-iptables-monitor/Dockerfile	Updates Go and Azure Linux pins.
azure-ipam/Dockerfile	Updates Go and Azure Linux pins.
azure-ip-masq-merger/Dockerfile	Updates Go and distroless pins.
.pipelines/build/dockerfiles/npm.Dockerfile	Updates the Windows Server Core image.
.pipelines/build/dockerfiles/cns.Dockerfile	Updates Azure Linux pins.
.pipelines/build/dockerfiles/cni.Dockerfile	Updates the distroless pin.
.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile	Updates Fluent Bit.
.pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile	Updates Azure Linux pins.
.pipelines/build/dockerfiles/azure-ipam.Dockerfile	Updates the distroless pin.
.pipelines/build/dockerfiles/azure-ip-masq-merger.Dockerfile	Updates the distroless pin.

Review details

Suppressed comments (1)

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• This update moves one consumer of mcr.microsoft.com/oss/go/microsoft/golang to 1.26.8-1, but npm/linux.Dockerfile:1 and npm/windows.Dockerfile:2 still build from 1.26.7. Those NPM images therefore remain on the old patch despite the same Docker dependency being updated here; update both builder tags as part of this bump.

FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:aee56ca8985f69b58b88b5bbe28c82c31d2beecc1e30ec2733b8759bc50ecca9 AS go

• Files reviewed: 14/14 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Template references and the Go image comment must be synchronized with the updated pins.

Review details

Suppressed comments (3)

.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile:5

• This rendered pipeline image is now pinned to v4.2.3-18, but .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl still emits v4.2.3-16. Running make dockerfiles or the base-images CI check will overwrite this change or report a mismatch; update the template and regenerate the output.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• The IMG command immediately above this new pin still references 1.26.7, so following the documented skopeo inspect command will resolve the old Go image rather than the 1.26.8-1 image being built. Keep the comment's tag aligned with the FROM tag.

FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:1c312e239157abd92e3eb83091ac5febb914b57eb117af7faa46659109632bdd AS go

cilium-log-collector/Dockerfile:16

• This rendered file is now pinned to v4.2.3-18, but both source templates (cilium-log-collector/Dockerfile.tmpl and .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl) still emit v4.2.3-16. make dockerfiles (and the base-images CI check) will therefore overwrite this update or fail; update the templates and regenerate both outputs.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite