openshift-hyperfleet · jsell-rh · Mar 23, 2026 · Dec 15, 2025 · Dec 16, 2025 · Dec 16, 2025
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -18,7 +18,7 @@ jobs:
 
     services:
       postgres:
-        image: apache/age:release_PG17_1.6.0
+        image: apache/age:release_PG18_1.7.0
         env:
           POSTGRES_USER: kartograph
           POSTGRES_PASSWORD: kartograph_dev_password
@@ -52,7 +52,7 @@ jobs:
           -p 50051:50051 \
           -p 50052:50052 \
           --entrypoint spicedb \
-          quay.io/authzed/spicedb:v1.48.0 \
+          quay.io/authzed/spicedb:v1.50.0 \
           serve-testing
 
       - name: Set up uv

diff --git a/compose.yaml b/compose.yaml
@@ -25,7 +25,7 @@ services:
       start_period: 30s
 
   spicedb:
-    image: authzed/spicedb:v1.48.0
+    image: authzed/spicedb:v1.50.0
     command: "serve"
     env_file:
       - env/spicedb.env
@@ -82,7 +82,7 @@ services:
         condition: service_healthy
 
   postgres:
-    image: apache/age:release_PG17_1.6.0
+    image: apache/age:release_PG18_1.7.0
     env_file:
       - env/postgres.env
     ports:

diff --git a/deploy/apps/kartograph/base/job-spicedb-migrate.yaml b/deploy/apps/kartograph/base/job-spicedb-migrate.yaml
@@ -39,7 +39,7 @@ spec:
               echo "DB init complete!"
       containers:
         - name: migrate
-          image: authzed/spicedb:v1.48.0
+          image: authzed/spicedb:v1.50.0
           imagePullPolicy: IfNotPresent
           args:
             - migrate

diff --git a/deploy/apps/kartograph/base/postgres-deployment.yaml b/deploy/apps/kartograph/base/postgres-deployment.yaml
@@ -19,7 +19,7 @@ spec:
       securityContext: {}
       containers:
         - name: postgres
-          image: apache/age:release_PG17_1.6.0
+          image: apache/age:release_PG18_1.7.0
           securityContext:
             runAsNonRoot: true
             allowPrivilegeEscalation: false

diff --git a/deploy/apps/kartograph/base/spicedb-deployment.yaml b/deploy/apps/kartograph/base/spicedb-deployment.yaml
@@ -39,7 +39,7 @@ spec:
               echo "Migration complete!"
       containers:
         - name: spicedb
-          image: authzed/spicedb:v1.48.0
+          image: authzed/spicedb:v1.50.0
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

diff --git a/src/api/Dockerfile b/src/api/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage - using Red Hat UBI9 Python image
-FROM registry.access.redhat.com/ubi9/python-312:9.7-1765181854 AS builder
+FROM registry.access.redhat.com/ubi9/python-312@sha256:d7b4607a07e0e831e7ea9a66d91dc39251ae3ce17bad540f2d19e44407073f9b AS builder
 
 # Install build dependencies for psycopg2 compilation
 USER 0
@@ -37,7 +37,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 
 
 # Production stage - using Red Hat UBI9 Python image
-FROM registry.access.redhat.com/ubi9/python-312:9.7-1765181854
+FROM registry.access.redhat.com/ubi9/python-312@sha256:d7b4607a07e0e831e7ea9a66d91dc39251ae3ce17bad540f2d19e44407073f9b
 # It is important to use the image that matches the builder, as the path to the
 # Python executable must be the same