chore(deps): update apache/age, spicedb, and ubi9 base images

.github/workflows/tests.yml

@@ -18,7 +18,7 @@ jobs:
 
     services:
       postgres:
-        image: apache/age:release_PG17_1.6.0
+        image: apache/age:release_PG18_1.7.0
         env:
           POSTGRES_USER: kartograph
           POSTGRES_PASSWORD: kartograph_dev_password
@@ -52,7 +52,7 @@ jobs:
           -p 50051:50051 \
           -p 50052:50052 \
           --entrypoint spicedb \
-          quay.io/authzed/spicedb:v1.48.0 \
+          quay.io/authzed/spicedb:v1.50.0 \
           serve-testing
 
       - name: Set up uv

compose.yaml

@@ -25,7 +25,7 @@ services:
       start_period: 30s
 
   spicedb:
-    image: authzed/spicedb:v1.48.0
+    image: authzed/spicedb:v1.50.0
     command: "serve"
     env_file:
       - env/spicedb.env
@@ -52,7 +52,7 @@ services:
       start_period: 10s
 
   spicedb-migrate:
-    image: "authzed/spicedb"
+    image: "authzed/spicedb:v1.50.0"
     command: "migrate head"
     restart: "on-failure"
     networks:
@@ -67,7 +67,7 @@ services:
 
   # Transient service to ensure the 'spicedb' database exists
   db-init:
-    image: postgres:17-alpine
+    image: postgres:18-alpine
     networks:
       - kartograph
     env_file:
@@ -82,7 +82,7 @@ services:
         condition: service_healthy
 
   postgres:
-    image: apache/age:release_PG17_1.6.0
+    image: apache/age:release_PG18_1.7.0
     env_file:
       - env/postgres.env
     ports:

deploy/apps/kartograph/base/job-db-init.yaml

@@ -17,7 +17,7 @@ spec:
       initContainers:
         # Wait for Postgres to be ready
         - name: wait-for-postgres
-          image: postgres:17-alpine
+          image: postgres:18-alpine
           imagePullPolicy: IfNotPresent
           command:
             - sh
@@ -30,7 +30,7 @@ spec:
               echo "PostgreSQL is ready!"
       containers:
         - name: init
-          image: postgres:17-alpine
+          image: postgres:18-alpine
           imagePullPolicy: IfNotPresent
           env:
             - name: PGHOST

deploy/apps/kartograph/base/job-spicedb-migrate.yaml

@@ -39,7 +39,7 @@ spec:
               echo "DB init complete!"
       containers:
         - name: migrate
-          image: authzed/spicedb:v1.48.0
+          image: authzed/spicedb:v1.50.0
           imagePullPolicy: IfNotPresent
           args:
             - migrate

deploy/apps/kartograph/base/postgres-deployment.yaml

@@ -19,7 +19,7 @@ spec:
       securityContext: {}
       containers:
         - name: postgres
-          image: apache/age:release_PG17_1.6.0
+          image: apache/age:release_PG18_1.7.0
           securityContext:
             runAsNonRoot: true
             allowPrivilegeEscalation: false

deploy/apps/kartograph/base/spicedb-deployment.yaml

@@ -39,7 +39,7 @@ spec:
               echo "Migration complete!"
       containers:
         - name: spicedb
-          image: authzed/spicedb:v1.48.0
+          image: authzed/spicedb:v1.50.0
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

src/api/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage - using Red Hat UBI9 Python image
-FROM registry.access.redhat.com/ubi9/python-312:9.7-1765181854 AS builder
+FROM registry.access.redhat.com/ubi9/python-312@sha256:d7b4607a07e0e831e7ea9a66d91dc39251ae3ce17bad540f2d19e44407073f9b AS builder
 
 # Install build dependencies for psycopg2 compilation
 USER 0
@@ -37,7 +37,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 
 
 # Production stage - using Red Hat UBI9 Python image
-FROM registry.access.redhat.com/ubi9/python-312:9.7-1765181854
+FROM registry.access.redhat.com/ubi9/python-312@sha256:d7b4607a07e0e831e7ea9a66d91dc39251ae3ce17bad540f2d19e44407073f9b
 # It is important to use the image that matches the builder, as the path to the
 # Python executable must be the same