.github/workflows/container-image.yml

@@ -15,7 +15,7 @@ jobs:
     - id: meta
       # > "automatic" tag management and OCI Image Format Spec… for labels
       # https://web.archive.org/web/20250103123053/https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@v6
       with:
         # see comment on `push: true` below
         images: ghcr.io/${{ github.repository_owner }}/postfix
@@ -25,13 +25,13 @@ jobs:
           type=ref,event=pr
           type=sha,format=long
           type=raw,value=latest,enable=false
-    - uses: docker/setup-qemu-action@v3.7.0
-    - uses: docker/login-action@v3
+    - uses: docker/setup-qemu-action@v4.0.0
+    - uses: docker/login-action@v4
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-    - uses: docker/setup-buildx-action@v3.12.0
+    - uses: docker/setup-buildx-action@v4.0.0
     # > By default, this action uses the Git context so you don't need to use
     # > the actions/checkout action to checkout the repository because this
     # > will be done directly by buildkit. [...]
@@ -40,7 +40,7 @@ jobs:
     # https://github.com/marketplace/actions/build-and-push-docker-images
     # > The commit history is not preserved.
     # https://docs.docker.com/engine/reference/commandline/build/#git-repositories
-    - uses: docker/build-push-action@v6.19.2
+    - uses: docker/build-push-action@v7.0.0
       with:
         platforms: |
           linux/amd64

Dockerfile

@@ -6,7 +6,7 @@
 #
 # SPDX-License-Identifier: EPL-2.0
 
-FROM docker.io/alpine:3.23.3
+FROM docker.io/alpine:3.23.4
 
 # http://www.postfix.org/announcements.html
 # https://git.alpinelinux.org/aports/log/main/postfix?h=3.23-stable
@@ -15,7 +15,7 @@ ARG POSTFIX_PACKAGE_VERSION=3.10.8-r0
 # https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
 # https://gitlab.alpinelinux.org/alpine/ca-certificates/-/commits/master
 # https://git.alpinelinux.org/aports/log/main/ca-certificates?h=3.23-stable
-ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20251003-r0
+ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20260413-r0
 RUN apk add --no-cache \
         ca-certificates=$MOZILLA_CA_CERT_STORE_PACKAGE_VERSION \
         postfix=$POSTFIX_PACKAGE_VERSION \