From 517b882dd538ca4b8b292a7e95cafe70bfc7665a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 11:21:02 +0000
Subject: [PATCH 1/2] chore(deps): update docker-images

---
 deploy/docker-compose.caddy.yml | 2 +-
 deploy/docker-compose.yml       | 2 +-
 deploy/relay/Dockerfile         | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/docker-compose.caddy.yml b/deploy/docker-compose.caddy.yml
index 4b11f5c7..677f9790 100644
--- a/deploy/docker-compose.caddy.yml
+++ b/deploy/docker-compose.caddy.yml
@@ -3,7 +3,7 @@
 
 services:
   caddy:
-    image: caddy@sha256:504a44d7d74bd2bc28a66afc4774912fc21223ca8a67734af1c54ab2f999b489 # 2-alpine
+    image: caddy@sha256:5e5286cb37d44086d651a5363f05f43a692ce4d649d88fb1bd844579f45fa9e8 # 2-alpine
     environment:
       DOMAIN: ${DOMAIN}
     ports:
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index e110c375..f5d54305 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -3,7 +3,7 @@
 
 services:
   postgres:
-    image: postgres@sha256:edb0c08dc33befd0262ab3b5cf1c4f3f8cfd8b09e88c05b45adee29d6761ddb6 # 17-alpine
+    image: postgres@sha256:979bccfde35445db618c65107d27d08c6c21339d8dc3ad4c830c6633947be0e4 # 17-alpine
     environment:
       POSTGRES_USER: micasa
       POSTGRES_DB: micasa
diff --git a/deploy/relay/Dockerfile b/deploy/relay/Dockerfile
index ebad2c21..5c1214c2 100644
--- a/deploy/relay/Dockerfile
+++ b/deploy/relay/Dockerfile
@@ -2,7 +2,7 @@
 # Licensed under the Apache License, Version 2.0
 
 # golang 1.27-alpine
-FROM golang@sha256:9048d5e7751706200eb1719c7dae0436950d362f29a1da91fa05e5c63867c60f AS build
+FROM golang@sha256:898838c455eecb68ed7b0b6f0635630ebdd657e732f07a23d0ab475007a52c36 AS build
 ARG BUILD_TAGS
 WORKDIR /src
 COPY go.mod go.sum ./

From ce6924e57db44dbff7b68e9dab805c8fe936cd1a Mon Sep 17 00:00:00 2001
From: Phillip Cloud <417981+cpcloud@users.noreply.github.com>
Date: Wed, 28 Oct 2026 07:35:08 -0400
Subject: [PATCH 2/2] fix(deps): bump golang.org/x/net to v0.62.0 for
 GO-2026-6860 and GO-2026-6866

The OSV scan job fails because OSV published two new advisories against
golang.org/x/net v0.61.0. Version v0.62.0 fixes both. The docker image
digest bump in this pull request did not cause the failure: main pins the
same x/net version, so its scan reports the same findings.

The Nix vendor hash changes with the module bump, so the package build
needs the new hash.

Generated with Claude Code (claude-opus-5-5)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 go.mod          | 2 +-
 go.sum          | 4 ++--
 nix/package.nix | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index 0c1e63cf..b8a9f529 100644
--- a/go.mod
+++ b/go.mod
@@ -126,7 +126,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.47.0 // indirect
 	go.opentelemetry.io/otel/trace v1.47.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	google.golang.org/api v0.308.0 // indirect
 	google.golang.org/genai v1.76.0 // indirect
diff --git a/go.sum b/go.sum
index dcf283e6..048f4c36 100644
--- a/go.sum
+++ b/go.sum
@@ -321,8 +321,8 @@ golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
 golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
 golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
diff --git a/nix/package.nix b/nix/package.nix
index 6842c968..a4a17ede 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -14,7 +14,7 @@ buildGoModule {
   inherit pname version;
   src = gitignoreSource ../.;
   subPackages = [ "cmd/micasa" ];
-  vendorHash = "sha256-B0FeOQzwPAx/g1Ch7HersckWyX2q7VXrbFKqkp5OdLY=";
+  vendorHash = "sha256-8p5Td2lPpDomHGhUNHbKndrKeUQ5yyFjqjVAqVXyvZ4=";
   env.CGO_ENABLED = 0;
   preCheck = ''
     export HOME="$(mktemp -d)"