Update postgres Docker tag to v18.7

Release-Bump: minor

.gitea/workflows/registry-cleanup.yml

@@ -19,4 +19,4 @@ jobs:
         run: |
           docker run --rm -v "$PWD:/repo" -w /repo \
             -e REGISTRY_TOKEN -e REGISTRY_USER -e REPO_TOKEN -e REPOSITORY -e SERVER_URL \
-            node:26.13.0-alpine3.24 node registry-cleanup/cleanup.ts
+            node:26.13.1-alpine3.24 node registry-cleanup/cleanup.ts

.gitea/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
           GIT_TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          docker run --rm -v "$PWD:/repo" -w /repo node:26.13.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:26.13.1-alpine3.24 \
             node release-tooling/contract-version.ts "$GIT_TAG" src/plugin-host/plugin.ts
       - name: Promote the commit-hash image to semver + latest
         env:
@@ -100,9 +100,9 @@ jobs:
           VERSION=${INPUT_VERSION:-${GIT_TAG#v}}
           VERSION=${VERSION#v}
           # An empty dispatch input falls back to the branch name, so gate this like a tag.
-          docker run --rm -v "$PWD:/repo" -w /repo node:26.13.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:26.13.1-alpine3.24 \
             node release-tooling/contract-version.ts "$VERSION" src/plugin-host/plugin.ts
           docker run --rm -v "$PWD:/repo" -w /repo \
             -e DOCKERHUB_REPO -e DOCKERHUB_TOKEN -e DOCKERHUB_USER \
-            node:26.13.0-alpine3.24 \
+            node:26.13.1-alpine3.24 \
             node release-tooling/dockerhub-overview.ts "$VERSION"

.gitea/workflows/renovate.yml

@@ -60,11 +60,11 @@ jobs:
           if [ -z "$BUMPS" ]; then
             echo "Renovate commits since ${LATEST}, but none carry Release-Bump — nothing reached a running Plainpages; skipping"; exit 0
           fi
-          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:26.13.0-alpine3.24 \
+          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:26.13.1-alpine3.24 \
                  node release-tooling/next-version.ts "$LATEST" $BUMPS)
           # Read the constant off origin/main, not the checkout, which lags the merges this run made.
           git show origin/main:src/plugin-host/plugin.ts \
-            | docker run -i --rm -v "$PWD:/repo" -w /repo node:26.13.0-alpine3.24 \
+            | docker run -i --rm -v "$PWD:/repo" -w /repo node:26.13.1-alpine3.24 \
                      node release-tooling/contract-version.ts "$NEXT" -
           echo "Releasing $LATEST -> $NEXT"
           git tag "$NEXT" origin/main

Dockerfile

@@ -1,5 +1,5 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
-FROM node:26.13.0-alpine3.24
+FROM node:26.13.1-alpine3.24
 
 # Above WORKDIR so dev's `.:/app` bind mount can't shadow them; a volume at /app/node_modules
 # instead leaves a root-owned dir in the checkout (the daemon creates mount destinations as root).

compose.override.yml

@@ -49,7 +49,7 @@ services:
   # backs it (PLUGIN_SETTING_SCHEDULING_UPSTREAM above points here). Stand-in for the customer's real service —
   # stdlib-only, in-memory, no auth. Prod points PLUGIN_SETTING_SCHEDULING_UPSTREAM at the real backend instead.
   shifts-upstream:
-    image: node:26.13.0-alpine3.24
+    image: node:26.13.1-alpine3.24
     command: node /srv/server.ts
     restart: unless-stopped
     volumes:

compose.yml

@@ -50,7 +50,7 @@ services:
   # A plugin connects as its own role from inside web. Dev defaults below; supply
   # POSTGRES_USER/PASSWORD via env in production.
   postgres:
-    image: postgres:18.6-alpine3.23
+    image: postgres:18.7-alpine3.23
     environment:
       POSTGRES_USER: ${POSTGRES_USER:-ory}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ory}

e2e-tests/compose.full.yml

@@ -53,7 +53,7 @@ services:
 
   # The reference plugin's upstream (examples/shifts-upstream) so /scheduling/shifts shows real rows.
   shifts-upstream:
-    image: node:26.13.0-alpine3.24
+    image: node:26.13.1-alpine3.24
     command: ["node", "/server.ts"]
     volumes:
       - ./examples/shifts-upstream/server.ts:/server.ts:ro
@@ -66,7 +66,7 @@ services:
   # Mock OIDC provider for the SSO login test — stdlib Node, auto-approves, signs an id_token Kratos
   # verifies via its jwks. Reachable as the same host (mock-oidc:9000) by both the browser and Kratos.
   mock-oidc:
-    image: node:26.13.0-alpine3.24
+    image: node:26.13.1-alpine3.24
     command: ["node", "/mock-oidc.ts"]
     environment:
       ISSUER: http://mock-oidc:9000
@@ -92,7 +92,7 @@ services:
 
   # Same-origin gateway: Kratos-owned paths → kratos, everything else → web (e2e-tests/proxy.ts).
   proxy:
-    image: node:26.13.0-alpine3.24
+    image: node:26.13.1-alpine3.24
     command: ["node", "/proxy.ts"]
     depends_on:
       web:

package-lock.json

@@ -6,13 +6,13 @@
     "": {
       "name": "plainpages",
       "dependencies": {
-        "@larvit/log": "2.4.0",
+        "@larvit/log": "2.5.0",
         "ejs": "7.0.2",
         "lucide-static": "1.70.0",
-        "postgres": "4.1.0"
+        "postgres": "4.1.1"
       },
       "devDependencies": {
-        "@mdn/browser-compat-data": "8.1.8",
+        "@mdn/browser-compat-data": "8.1.9",
         "@types/ejs": "3.1.5",
         "@types/node": "26.6.6",
         "acorn": "8.19.0",
@@ -23,18 +23,18 @@
       }
     },
     "node_modules/@larvit/log": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.4.0.tgz",
-      "integrity": "sha512-0BA1S0eSzQMOP527Vy2DL9Zb68TiCgyDACr0gDiI2b/1zfY6Axq9XhR/ZJnF9URIAhQwFPYs3W6lh/T9K8vqgQ==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.5.0.tgz",
+      "integrity": "sha512-xky7OVFDw4Ftf60Syn0eKT47xSepbjcghiwIS5NCyawZc/TVR0YWnDrWubc1sO0/MC2m2j0HdxirsZj0APf05A==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/@mdn/browser-compat-data": {
-      "version": "8.1.8",
-      "resolved": "https://registry.npmjs.org/@mdn/browser-compat-data/-/browser-compat-data-8.1.8.tgz",
-      "integrity": "sha512-+RK7inkLeZ70kr9Mo+Y81JjZMpQIt0Sx40tHHU0hXGDSdf9YvlawH+4WlUpP3SE8rFLmjqGiTzL+qPPPnncWDw==",
+      "version": "8.1.9",
+      "resolved": "https://registry.npmjs.org/@mdn/browser-compat-data/-/browser-compat-data-8.1.9.tgz",
+      "integrity": "sha512-7d8D9yzVS4ugLbt4clzc5DKU8dq85K0lRebjzpP43GxSr7vYKmczgfuEU+0beimjl5YmnHkcErtolg5t5ttb0A==",
       "dev": true,
       "license": "CC0-1.0"
     },
@@ -427,9 +427,9 @@
       "license": "ISC"
     },
     "node_modules/postgres": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-4.1.0.tgz",
-      "integrity": "sha512-s+0WH67YAyLdBQUb6XczbziBhY+C9uiQsg9S8R5RHdZhk6sdyK6202E+T2tXpiInSEEjDLRSJ3OpYBe3PN6MsQ==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-4.1.1.tgz",
+      "integrity": "sha512-1kJDojqNZC+iTHHXh6eif0J98LUtyLAePe/qkW1GK35eh2JixlsAiIKq3FGI+xqI+SUGTNodzf7TScVeIIyUug==",
       "license": "Unlicense",
       "engines": {
         "node": ">=18"

package.json

@@ -16,13 +16,13 @@
     "test": "node --test \"src/**/*.test.ts\" \"plugins/**/*.test.ts\" \"examples/**/*.test.ts\" \"registry-cleanup/**/*.test.ts\" \"release-tooling/**/*.test.ts\""
   },
   "dependencies": {
-    "@larvit/log": "2.4.0",
+    "@larvit/log": "2.5.0",
     "ejs": "7.0.2",
     "lucide-static": "1.70.0",
-    "postgres": "4.1.0"
+    "postgres": "4.1.1"
   },
   "devDependencies": {
-    "@mdn/browser-compat-data": "8.1.8",
+    "@mdn/browser-compat-data": "8.1.9",
     "@types/ejs": "3.1.5",
     "@types/node": "26.6.6",
     "acorn": "8.19.0",

release-tooling/dockerhub-overview.md.tmpl

@@ -54,7 +54,7 @@ services:
     restart: "on-failure:5"
 
   postgres:
-    image: postgres:18.6-alpine3.23
+    image: postgres:18.7-alpine3.23
     environment:
       POSTGRES_DB: ory
       POSTGRES_PASSWORD: ory