From 4cc8487c6325e904ae1dbba953aa93e38a4b6537 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 29 Aug 2026 08:48:00 +0000
Subject: [PATCH] chore(deps): update bump-dependencies

---
 .github/workflows/push.yaml |  2 +-
 Dockerfile                  | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index cce0182..fdc42fb 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -15,7 +15,7 @@ jobs:
           verbose: true
   push:
     needs: [lint]
-    uses: libops/.github/.github/workflows/build-push.yaml@5f44a8c8d157bb7e5cf6d9e1c98847a604e87455 # main
+    uses: libops/.github/.github/workflows/build-push.yaml@e1b8f81b967cead6942fc0e6695cddc754933f74 # main
     permissions:
       contents: read
       packages: write
diff --git a/Dockerfile b/Dockerfile
index 78b6a37..37aa54b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ ARG \
   # renovate: datasource=go depName=golang.org/x/vuln
   GOVULNCHECK_VERSION=v1.7.0 \
   # renovate: datasource=go depName=github.com/securego/gosec/v2
-  GOSEC_VERSION=v2.28.0 \
+  GOSEC_VERSION=v2.29.0 \
   # renovate: datasource=go depName=github.com/rhysd/actionlint
   ACTIONLINT_VERSION=v1.7.12 \
   # renovate: datasource=go depName=github.com/bufbuild/buf
@@ -19,7 +19,7 @@ ARG \
   # renovate: datasource=go depName=github.com/sqlc-dev/sqlc
   SQLC_VERSION=v1.31.1
 
-FROM node:24-trixie@sha256:66bb8d36ae1ddd72199ed235a089904874ca4079ee517936ca3adb80506a75c1 AS go-tools-builder
+FROM node:24-trixie@sha256:f7d34e58713740f9eef9092c0bd6ff10369d132f7238399a4b270f16d47fa608 AS go-tools-builder
 
 ARG \
   TARGETARCH \
@@ -61,7 +61,7 @@ RUN --mount=type=cache,id=go-tools-mod-${TARGETARCH},sharing=locked,target=/root
   go install github.com/bufbuild/buf/cmd/buf@"${BUF_VERSION}" && \
   go install github.com/sqlc-dev/sqlc/cmd/sqlc@"${SQLC_VERSION}"
 
-FROM node:24-trixie@sha256:66bb8d36ae1ddd72199ed235a089904874ca4079ee517936ca3adb80506a75c1
+FROM node:24-trixie@sha256:f7d34e58713740f9eef9092c0bd6ff10369d132f7238399a4b270f16d47fa608
 
 ARG TZ
 ENV TZ="$TZ"
@@ -82,11 +82,11 @@ ARG \
   # renovate: datasource=repology depName=debian_13/bind9
   BIND9_VERSION=1:9.20.26-1~deb13u1 \
   # renovate: datasource=repology depName=debian_13/bubblewrap
-  BW_VERSION=0.11.0-2+deb13u1 \
+  BW_VERSION=0.12.0-1~deb13u1 \
   # renovate: datasource=deb depName=docker-ce
   DOCKER_CE_VERSION=5:29.7.2-1~debian.13~trixie \
   # renovate: datasource=deb depName=containerd.io
-  CONTAINERD_IO_VERSION=2.3.3-1~debian.13~trixie \
+  CONTAINERD_IO_VERSION=2.3.4-1~debian.13~trixie \
   # renovate: datasource=deb depName=docker-buildx-plugin
   DOCKER_BUILDX_PLUGIN_VERSION=0.36.1-1~debian.13~trixie \
   # renovate: datasource=deb depName=docker-compose-plugin
@@ -259,11 +259,11 @@ ENV \
 
 ARG \
   # renovate: datasource=npm depName=@anthropic-ai/claude-code
-  CLAUDE_CLI_VERSION=2.1.239 \
+  CLAUDE_CLI_VERSION=2.1.246 \
   # renovate: datasource=npm depName=@openai/codex
   CODEX_CLI_VERSION=0.149.1 \
   # renovate: datasource=npm depName=@earendil-works/pi-coding-agent
-  PI_CLI_VERSION=0.84.2 \
+  PI_CLI_VERSION=0.84.3 \
   CLI=""
 
 RUN if [ -n "$CLI" ]; then \