[dependabot]

Bumps alpine from be26560 to f59abe6.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Farjaad]

Automated review written by an AI coding agent (OpenCode) on behalf of @Farjaad.

Verdict: safe to merge

• Diff: a single line in Dockerfile changes the runtime base image from alpine:latest@sha256:be26560… to @sha256:f59abe6…. One commit by dependabot; no other files changed.
• Digest check: f59abe6… is the current official library/alpine:latest on Docker Hub and the same image as the 3.24.4 tag. Same 8 platforms as before.
• Version: Alpine 3.24.3 → 3.24.4 (patch release; checked with /etc/alpine-release in both images).
• Release notes (3.24.4): security fixes only, including an openssh-server password-login bypass and an apk-tools crash on malformed data. No breaking changes.
  • The openssh fix doesn't affect us: the image doesn't install or run sshd.
  • The apk-tools fix is a small plus, since the Dockerfile runs apk --no-cache upgrade.
• How we use it: final stage only. We copy in CA certs and the prebuilt opslevel-runner binary, which is the entrypoint. Nothing depends on what's inside Alpine beyond that.
• CI: test ✅, generate-changelog ✅, CodeQL skipped (no code changes).